CVE-2025-31626 WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through = 4.5.2...

CVE-2025-31626

CVE-2025-31626 is a reflected Cross-Site Scripting vulnerability affecting the WordPress plugin Support Helpdesk Ticket System Lite (≤ 4.5.2). The CVE entry indicates an input neutralization issue during web page generation leading to reflected XSS. Current connected data confirms the issue is re...

CVE-2025-31626 WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through = 4.5.2...

CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2...

CVE-2025-31131

YesWiki before 4.5.2 is vulnerable to an unauthenticated path traversal via the squelette parameter, allowing read access to arbitrary server files (e.g., /etc/passwd). Root cause: unsafe handling of user-controllable squelette input leading to directory traversal. Impact: potential data exposure...

CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2...

YesWiki 路径遍历漏洞

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative manner. A path traversal vulnerability exists in YesWiki versions prior to 4.5.2, which stems from the squelette parameter being vulnerable to a path traversal...

SUSE CVE-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

Asymmetric Resource Consumption (Amplification)

Overview Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification through the parse.ParseUnverified function. An attacker can cause excessive memory allocation by sending a crafted request with many period characters in the Authorization header. Remediatio...

CVE-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

GriceMobile com.grice.call 安全漏洞

GriceMobile com.grice.call is an application from GriceMobile, Inc. A security vulnerability exists in GriceMobile com.grice.call version 4.5.2, which originates from allowing any installed application to send a crafted intent to make a phone call without user interaction via...

Closed Loop CLESS Server 安全漏洞

Closed Loop CLESS Server is an industrial system from Closed Loop, Inc. A security vulnerability exists in Closed Loop CLESS Server version v4.5.2, which originates from an arbitrary file upload issue in the Media Manager functionality that allows users to execute arbitrary code by uploading a...

WordPress Plugin Essential Blocks Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

Security feature bypass

Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability...

PT-2023-31818 · Unknown · Verge3D Publishing +1

Name of the Vulnerable Software and Affected Versions: Verge3D Publishing and E-Commerce versions n/a through 4.5.2 Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability. This vulnerability affects Verge3D Publishing and E-Commerce...

WordPress WP Meta SEO Plugin <= 4.5.2 is vulnerable to SQL Injection

Software WP Meta SEO Type Plugin Vulnerable versions = 4.5.2 Fixed in 4.5.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID ed22c0b021d4 Credits WordFence Required privilege Subscriber Published 23 February,...

SUSE CVE-2016-4566

Cross-site scripting XSS vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution SOME attack...

PT-2022-8697 · Unknown · Easywebpack-Cli

Name of the Vulnerable Software and Affected Versions: easywebpack-cli versions prior to 4.5.2 Description: A Directory Traversal issue allows attackers to obtain sensitive information by sending a crafted GET request. Recommendations: For versions prior to 4.5.2, update to version 4.5.2 or later...

CVE-2022-2080

The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see...

PT-2022-14843 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: Sensei LMS WordPress plugin versions prior to 4.5.2 Description: The issue allows any authenticated user to send messages to arbitrary private conversations via an IDOR attack, as the plugin does not ensure that the sender of a private messag...