PT-2025-38306

Name of the Vulnerable Software and Affected Versions WP Legal Pages plugin for WordPress versions up to and including 3.4.3 Description The WP Legal Pages plugin for WordPress is susceptible to unauthorized access of functionality due to a missing capability check on the wplp gdpr install plugin...

WordPress Ghost Kit plugin <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Ghost Kit versions = 3.4.3...

CVE-2025-53529

WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profilefuncionario.php endpoint. The idfuncionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to...

CVE-2025-53526

WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novomemorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listarmemorandosantigos.php. Upon loading this page, the injected script was executed in the browser...

CVE-2025-53529

WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profilefuncionario.php endpoint. The idfuncionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to...

CVE-2025-53377

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the cadastrodependentepessoanova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the idfuncionario parameter. This...

CVE-2025-53525

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the profilefamiliar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the iddependente parameter. This vulnerability is...

CVE-2025-53526 WeGIA allows Stored XSS attacks in novo_memorando.php

WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novomemorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listarmemorandosantigos.php. Upon loading this page, the injected script was executed in the browser...

CVE-2025-53526

WeGIA is affected by a stored XSS in the file for memos (novo_memorando.php). The vulnerability is triggered when a memo is submitted and is executed in the browser upon loading listar_memorandos_antigos.php. The issue affects WeGIA versions prior to 3.4.3 and is fixed in 3.4.3. Remediation: upgr...

CVE-2025-53526 WeGIA allows Stored XSS attacks in novo_memorando.php

WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novomemorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listarmemorandosantigos.php. Upon loading this page, the injected script was executed in the browser...

CVE-2025-53525 WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameter

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the profilefamiliar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the iddependente parameter. This vulnerability is...

CVE-2025-53525 WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameter

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the profilefamiliar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the iddependente parameter. This vulnerability is...

CVE-2025-53525

The CVE-2025-53525 entry concerns WeGIA, a web manager for charitable organizations. A concrete vulnerability exists in the profile_familiar.php endpoint where the id_dependente parameter enables reflected Cross-Site Scripting (XSS). The root cause is insufficient filtering/escaping of user-suppl...

CVE-2025-53525 WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameter

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the profilefamiliar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the iddependente parameter. This vulnerability is...

PT-2025-25708 · Unknown · Ecommerce Product Catalog

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog versions prior to 3.4.3 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in the impleCode eCommerce Product Catalog. Recommendations: For versions prior to 3.4.3,...

CVE-2024-0979

The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-41304

An arbitrary file upload vulnerability in the uploadFileAction function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2023-39305

Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through = 3.4.3...

CVE-2023-23813

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Calendar plugin = 3.4.3 versions...

CVE-2022-45208

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin...