EUVD-2025-25428

Malicious code in bioql PyPI...

EUVD-2025-25309

Malicious code in bioql PyPI...

EUVD-2025-26652

Malicious code in bioql PyPI...

EUVD-2023-38151

Malicious code in bioql PyPI...

EUVD-2025-24893

Malicious code in bioql PyPI...

EUVD-2025-31773

Malicious code in bioql PyPI...

EUVD-2025-28048

Malicious code in bioql PyPI...

EUVD-2023-27897

Malicious code in bioql PyPI...

EUVD-2025-27683

Malicious code in bioql PyPI...

EUVD-2024-34849

Malicious code in bioql PyPI...

EUVD-2023-34145

Malicious code in bioql PyPI...

EUVD-2025-27841

Malicious code in bioql PyPI...

EUVD-2025-24790

Malicious code in bioql PyPI...

CVE-2025-9697

CVE-2025-9697 affects the Ajax WooSearch WordPress plugin (versions

CVE-2025-9697 Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

GHSA-HG3J-6PMH-MVJR Fiora chat user avatar is vulnerable to XSS via SVG files

Cross Site Scripting XSS vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users...

CVE-2025-10189

The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdmlogin' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Fiora 跨站脚本漏洞

Fiora - is a chat application by yinxin630 individual developer. A cross-site scripting vulnerability exists in Fiora version 1.0.0, which originates from the execution of arbitrary JavaScript while rendering a malicious SVG file, and could lead to a cross-site scripting attack...

CVE-2025-56392

An Insecure Direct Object Reference IDOR in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perform arbitrary operations via a crafted POST request...