atlassian-bitbucket-server-integration allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. atlassian-bitbucket-server-integration implements this extension point to support OAuth 1.0 authentication. In atlassian-bitbucket-server-integration 2.1.0 through 4.1.3 both...

CVE-2025-22262

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This issue affects Bonjour Bar: from n/a through = 1.0.0...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite is a set of fully integrated global business management software from Oracle USA. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business Suite versions 12.2....

Brave Browser 输入验证错误漏洞

Brave Browser is a fast, private and secure web browser for PC, Mac and mobile devices from Brave, Inc. An input validation error vulnerability exists in Brave Browser versions 1.70.x through 1.73.x. The vulnerability stems from the source of a site not being correctly identified in the file...

CVE-2025-23677

Cross-Site Request Forgery CSRF vulnerability in DSmidge HTTP to HTTPS link changer by Eyga.net https-links-in-content allows Stored XSS.This issue affects HTTP to HTTPS link changer by Eyga.net: from n/a through = 0.2.4...

CVE-2025-23456

Cross-Site Request Forgery CSRF vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through = 2.2.1...

CVE-2025-23533

CVE-2025-23533 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WP Lyrics that enables a Stored XSS . The Red Hat entry and related records describe the issue as affecting WP Lyrics: from n/a through 0.4.1 . The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L ,...

PT-2025-5169 · Annie · Annie

Name of the Vulnerable Software and Affected Versions: Annie versions n/a through 2.1.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious scripts into...

PMB platform 安全漏洞

PMB platform is a free document management software from PMB Inc. A security vulnerability exists in PMB platform versions 4.0.10 through 4.2.13, which originated from a vulnerability that allows an attacker to keep temporary files on the server...

CVE-2025-22758

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through = 2.2.1...

XINJE XDPPro 安全漏洞

XINJE XDPPro is a USB port connection programming software using PLCs from China XINJE XINJE. A security vulnerability exists in XINJE XDPPro versions 3.2.2 through 3.7.17c, which originates from an insecure privilege in the XNetSocketClient component that allows an attacker to execute arbitrary...

PT-2025-4296 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.2.0 through 0.4.0 Description: The Vyper Compiler has a vulnerability when using the precompiles EcRecover 0x1 and Identity 0x4, where the success flag of the call is not checked. This allows an attacker to provide a specific...

CVE-2024-56323

OpenFGA Open Authorization Engine (versions v1.3.8–v1.8.2; Helm openfga-0.1.38–0.2.19; docker 1.3.8–1.8.2) contains a critical authorization bypass vulnerability (CVE-2024-56323). Root cause: when a model uses conditions and contextual tuples are provided in Check or ListObjects calls, and OPENFG...

PT-2025-4493 · Lucidlms · Lucidlms

Name of the Vulnerable Software and Affected Versions: LucidLMS versions n/a through 1.0.5 Description: The issue is an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This can be exploited through reflected XSS, whe...

Pegasystem PEGA Platform 安全漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem, USA. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-Time Decision Making and CRM Customer Relationship Management. A security vulnerability exists...

CVE-2024-13308

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Browser Back Button allows Cross-Site Scripting XSS.This issue affects Browser Back Button: from 1.0.0 before 2.0.2...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13298 Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting XSS.This issue affects Tarte au Citron: from 2.0.0 before 2.0.5...

CVE-2024-13284 Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

Cross-Site Request Forgery CSRF vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5...

CVE-2025-22820 WordPress VR Views plugin <= 1.5.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel Walmsley VR Views allows Stored XSS.This issue affects VR Views: from n/a through 1.5.1...