@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +42 more potentially affected by CVE-2025-32395 via vite (>=6.0.0, <=6.0.11)

vite NPM version =6.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =19.1.0-snapshot-1740051612326, =19.1.0-snapshot-1740051612326, =2.9.2, =2.9.2, =2.11.5 and more Source cves: CVE-2025-32395 Source advisory: OSV:GHSA-356W-63V5-8WF4...

MediaWiki 输入验证错误漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia USA Foundation. The product can be used to deploy in-house knowledge management and content management systems. MediaWiki - A security vulnerability exists in Wikidata Extension versions 1.39 through 1.43,...

PT-2025-15953 · Tutor Lms · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS versions n/d through 3.4.0 Description: The issue is related to an improper neutralization of script-related HTML tags in a web page, which can lead to a basic Cross-Site Scripting XSS attack. This allows an attacker to inject...

CVE-2025-31391

Cross-Site Request Forgery CSRF vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through = 1.7.1...

CVE-2025-31017

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows Stored XSS.This issue affects Nav Menu Manager: from n/a through = 3.2.5...

PT-2025-15761 · Unknown · Ab-Tools Flags Widget

Name of the Vulnerable Software and Affected Versions: ab-tools Flags Widget versions 1.0.0 through 1.0.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Flags Widget. Recommendations: For versions 1.0.0 through 1.0.7, update to a...

Apache ActiveMQ Artemis 安全漏洞

Apache ActiveMQ Artemis is a high-performance open source messaging agent from the Apache USA Foundation. A security vulnerability exists in Apache ActiveMQ Artemis version 1.5.1 through versions prior to 2.40.0, which stems from sensitive information being written to log files...

CVE-2025-32118

Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through = 4.1.14...

CVE-2025-32203

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in manu225 Falling things falling-things allows SQL Injection.This issue affects Falling things: from n/a through = 1.08...

CVE-2025-32165

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through = 2.5.1...

CVE-2025-32127

CVE-2025-32127 concerns an SQL Injection in onOffice for WP-Websites (WordPress plugin) where improper neutralization of special elements in SQL commands is reported. Affected version range is onOffice for WP-Websites: from n/a through 5.7. The provided material cites a base score of 7.6 (HIGH) w...

CVE-2025-3087

Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts...

WordPress plugin Booster for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2025-31127 Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. Thi...

CVE-2025-31815

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in devscred Design Blocks exclusive-blocks allows Stored XSS.This issue affects Design Blocks: from n/a through = 1.2.5...

Element X iOS 信息泄露漏洞

Element X iOS is an Element open source next-generation Matrix client for iOS built on SwiftUI for Matrix rust-sdk. An information disclosure vulnerability exists in Element X iOS versions 1.6.13 through 25.03.7, which originates in the element.json file and could lead to the disclosure of media...

Open Solutions For Education openSIS 安全漏洞

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS versions v8.0 through v9.1 that stems from a directory traversal issue...

CVE-2025-31697

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...

@514labs/design-system-base (>=0.4.13, <=0.4.69), @514labs/event-capture (>=0.4.13, <=0.4.69) +9 more potentially affected by CVE-2025-30218 via next (14.2.25)

next NPM version 14.2.25 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @514labs/design-system-base =0.4.13, =0.4.13, =0.1.0, =1.0.8, =0.1.99, =2.1.28, =3.0.5, =3.0.6 - upcloud 1.1.4 Source cves: CVE-2025-30218 Source...

CVE-2025-31549

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Agency Dominion Inc. Fusion fusion allows DOM-Based XSS.This issue affects Fusion: from n/a through = 1.6.4...