CVE-2025-31614

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through = 1.0.5...

CVE-2025-31762

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in andreyazimov Sheet2Site sheet2site allows Stored XSS.This issue affects Sheet2Site: from n/a through = 1.0.18...

CVE-2025-31883

Technical details for CVE-2025-31883 are not provided in the connected documents; the available info mentions a Stored XSS in WebinarPress/WP-WebinarSystem (WordPress plugin) but gives no specifics on affected versions, vectors, impact, or remediation.

CVE-2025-31871

CVE-2025-31871 corresponds to an Open Redirect vulnerability in the WordPress plugin WP Clone any post type (

Drupal AI Vulnerable to OS Command Injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Drupal AI Artificial Intelligence allows OS Command Injection. This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.5...

Drupal Core Vulnerable to Forceful Browsing

Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-31685

The Drupal Open Social platform (specifically the goalgorilla/open_social package) is vulnerable to a Missing Authorization flaw allowing Forceful Browsing . The root cause is a site administration configuration that fails to properly check access permissions when attempting to translate the plat...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-31438

Cross-Site Request Forgery CSRF vulnerability in Benoit De Boeck WP Supersized wp-supersized allows Cross Site Request Forgery.This issue affects WP Supersized: from n/a through = 3.1.6...

CVE-2025-31094

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through = 1.3.8...

CVE-2025-31096

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through = 4.1.25...

CVE-2025-30779

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through = 2.10.7...

CVE-2025-30783

Cross-Site Request Forgery CSRF vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through = 16.0...

CVE-2024-12619 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects...

CVE-2025-30890

CVE-2025-30890 is a PHP Local File Inclusion flaw in the WordPress plugin “Login Widget for Ultimate Member,” caused by improper filename handling in include/require paths. Affected: Login Widget for Ultimate Member (versions up to 1.1.2). Impact (as per CVSS metrics): attacker can read/modify/ex...

CVE-2025-30823

CVE-2025-30823 describes a Cross-Site Request Forgery (CSRF) vulnerability in Anthologize, affecting versions from unspecified n/a up to 0.8.2. The description confirms a CSRF flaw but provides no root-cause details beyond the generic CSRF label and does not supply exploit conditions, affected en...

CVE-2025-2600

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATEDPASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24...

CVE-2025-30540

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through = 1.2...

PT-2025-12984 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 9.12.0 through 11.4.0 Description: Directus is a real-time API and App dashboard for managing SQL database content. When a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a...

Directus 信息泄露漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. An information disclosure vulnerability exists in Directus versions prior to 9.0.0-alpha.4 through 11.5.0, which stems from the search parameter that can lead to unauthorized...