808 matches found
CVE-2025-31577
Unrestricted Upload of File with Dangerous Type vulnerability in appointify Appointify appointify allows Upload a Web Shell to a Web Server.This issue affects Appointify: from n/a through = 1.0.8...
CVE-2025-30817
Missing Authorization vulnerability in wpzita Z Companion z-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Z Companion: from n/a through = 1.0.13...
BIT-GITLAB-2024-9773 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicio...
CVE-2025-31440
Cross-Site Request Forgery CSRF vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a through = 2.0...
CVE-2025-31102
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through = 1.1.5.5...
CVE-2025-26762
CVE-2025-26762 is a stored XSS vulnerability in Automattic WooCommerce (affected: WooCommerce plugin <= 9.7.0). The issue arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Several sources (NVD, Red Hat, CVE list, CVE landing) confirm th...
CVE-2025-2857 Incorrect handle could lead to sandbox escapes
Following the recent Chrome sandbox escape CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was...
CVE-2025-2242
An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...
CVE-2025-2242 Incorrect Authorization in GitLab
An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...
CVE-2025-26560 WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound WP Contact Form III allows Reflected XSS. This issue affects WP Contact Form III: from n/a through 1.6.2d...
BIT-HUBBLE-RELAY-2025-30162 East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to...
CVE-2025-30534
Cross-Site Request Forgery CSRF vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through = 1.2...
CVE-2025-30540
CVE-2025-30540 affects AvaiBook vacation rental booking engine (AvaiBook <= 1.2). It is described as a Stored XSS (Improper Neutralization of Input During Web Page Generation) in AvaiBook. The connected Wordfence report lists AvaiBook
CVE-2025-25035
Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 SP8, before 10.0.7 SP7, before 10.0.6 SP6 and Jalios Workplace 6.2, Jalios Workplace 6.1,...
CVE-2025-25035
The CVE-2025-25035 issue affects Jalios JPlatform 10 (before 10.0.8 SP8, before 10.0.7 SP7, before 10.0.6 SP6) and Jalios Workplace 5.3–5.5 up to 6.2/6.1/6.0, with both Reflected and Stored XSS reported. Root cause: Improper Neutralization of Input During Web Page Generation, leading to cross-sit...
Juniper Junos OS Local Arbitrary Code Execution (JSA93446)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA93446 advisory: - An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the...
CVE-2025-26976 WordPress PrivateContent plugin <= 8.11.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through = 8.11.4...
GitLab 12.3 < 17.7.7 / 17.8 < 17.8.5 / 17.9 < 17.9.2 (CVE-2025-1257)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an...
Joomla! RCE Vulnerability (20250301)
Joomla! is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...