M-Files Server 安全漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server versions prior to 25.3.14681.7, which stems from stored cross-site scripting and could lead to script execution by a local user...

BIT-DOLIBARR-2022-0414 Improper Validation of Specified Quantity in Input in dolibarr/dolibarr

Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0...

DEBIAN-CVE-2025-3069

Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

MetaCPAN Sub::HandlesVia 代码问题漏洞

MetaCPAN Sub::HandlesVia is a library of the MetaCPAN Foundation. A code issue vulnerability exists in versions prior to MetaCPAN Sub::HandlesVia 0.050002 that stems from allowing untrusted code to be loaded from the current working directory, which could lead to the execution of arbitrary code...

CVE-2025-31697 Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...

CVE-2025-31695

CVE-2025-31695 affects the Drupal Link field display mode formatter. The issue is Improper Neutralization of Input During Web Page Generation (XSS) in the module, allowing cross-site scripting. Affected versions are 0.0.0 through 1.6.0; the component is the Link field display mode formatter. Root...

OpenEMR 代码问题漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A code issue vulnerability exists in versions prior to OpenEMR 7.0.3.1 that stems...

Drupal Cache Utility 跨站请求伪造漏洞

Drupal Cache Utility is a tool module for the Drupal community to manage and optimize the Drupal cache. A cross-site request forgery vulnerability exists in Drupal Cache Utility versions prior to 1.2.1 that stems from cross-site request forgery...

Drupal AI 操作系统命令注入漏洞

Drupal AI is a module or solution for the Drupal community that integrates artificial intelligence capabilities. An operating system command injection vulnerability exists in Drupal AI versions prior to 1.0.5, which stems from improper neutralization of a special element and could lead to os...

CVE-2024-10105

The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-20233

In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the chmod and makedirs Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-privileged user...

CVE-2025-26986

The CVE-2025-26986 entry concerns Pearl - Corporate Business WordPress theme (StylemixThemes). Affected component is PHP code handling include/require in the WordPress/PHP environment, enabling Local File Inclusion due to improper filename control, effectively a PHP Remote File Inclusion style is...

WordPress Slider by 10Web plugin < 1.2.62 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Slider by 10Web versions 1.2.62...

CVE-2024-13118

The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack...

CVE-2024-10638

The Product Labels For Woocommerce Sale Badges WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1452 Favorites < 2.3.5 - Admin+ Stored XSS

The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13123 AFI < 1.100.0 - Admin+ Stored XSS

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12682 Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS

The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-12805 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions prior to 1.51 Description: The issue concerns an information disclosure where users invited as "App Viewer" can access development information of a workspace, specifically getting a list of datasources. This does not expose...

AZL-77493 CVE-2025-30204 affecting package cf-cli for versions less than 8.4.0-27

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...