3231 matches found
CVE-2025-40647 Stored Cross-Site Scripting (XSS) vulnerability in Issabel products
Stored Cross-Site Scripting XSS vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'email' parameter in '/index.php?menu=addressbook'...
Issabel 跨站脚本漏洞
Issabel is a unified communications platform from the Issabel organization. A cross-site scripting vulnerability exists in Issabel version 5.0.0 that stems from a lack of validation of user input and could lead to a stored cross-site scripting attack...
PT-2025-40241
Name of the Vulnerable Software and Affected Versions Issabel version 5.0.0 Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The issue is triggered through the numero conferencia parameter in the '/index.php?menu=conferencia' API...
PT-2025-40240
Name of the Vulnerable Software and Affected Versions Issabel version 5.0.0 Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The issue is triggered through the email parameter in the '/index.php?menu=address book' API endpoint. This...
Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)
Summary DS8900F and DS8A00 updates have been released to remediate vulnerabilities in libexpat, libxml2, libsoup and krb5 libraries. Review the Vulnerability Details section below for additional information. Vulnerability Details CVEID:CVE-2024-8176 DESCRIPTION: A stack overflow vulnerability...
CVE-2025-7038
The vulnerability CVE-2025-7038 affects LatePoint for WordPress (up to v5.1.94). The issue is an Authentication Bypass in the steps__load_step path of the latepoint_route_call AJAX endpoint, where client-supplied customer email/fields are used before login verification or nonce checks. Unauthenti...
PT-2025-39956
Name of the Vulnerable Software and Affected Versions LatePoint plugin for WordPress versions through 5.1.94 Description The LatePoint plugin for WordPress has a flaw that allows bypassing authentication. This is due to inadequate identity verification within the steps load step route of the...
PT-2025-39955
Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94 Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is...
CVE-2025-4957
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Reflected XSS.This issue affects ProfileGrid : from n/a through = 5.9.5.7...
WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by theviper17 in WordPress Plugin Icegram Express Pro versions = 5.9.5...
CVE-2025-10036
The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getallurls function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2025-9985 Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
The Featured Image from URL FIFU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...
PT-2025-39565
Name of the Vulnerable Software and Affected Versions Potenzaglobalsolutions PGS Core versions through 5.9.0 Description A flaw exists in Potenzaglobalsolutions PGS Core that allows SQL Injection due to improper neutralization of special elements used in an SQL command. This could allow an attack...
WordPress plugin PGS Core SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injectio...
GHSA-XQ4F-3JXP-QV6M csvjson vulnerable to prototype injection
A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
CVE-2025-58260
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Stored XSS.This issue affects Highlight and Share: from n/a through = 5.1.1...
csvjson 安全漏洞
csvjson is a csv to json library by Pradeep Personal Developer. A security vulnerability exists in csvjson 5.1.0 and earlier versions, which stems from prototype contamination in the toCsv function, which allows an attacker to inject properties via a specially crafted payload, potentially resulti...
CVE-2025-57324
The CVE-2025-57324 entry concerns the Parse-SDK-JS library. A prototype pollution flaw exists in SingleInstanceStateController.initializeState, allowing a crafted payload to inject properties into Object.prototype. Affected versions are parse 5.3.0 and earlier. Consequences include denial of serv...
WordPress plugin Widget Options - Extended 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...