WordPress Mixcloud Embed plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by johska in WordPress Plugin Mixcloud Embed versions = 2.2.0...

CVE-2025-46534

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DanielRiera Image Style Hover image-content-show-hover allows DOM-Based XSS.This issue affects Image Style Hover: from n/a through = 1.0.6...

CVE-2025-46472

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through = 2.1.6...

CVE-2025-46491

CVE-2025-46491 describes a Stored XSS in the WordPress plugin Multi-Column Taxonomy List caused by improper neutralization of input during web page generation. The vulnerability affects versions up to 1.5 (as reported). The connected documents confirm the XSS type and the affected plugin, but the...

CVE-2025-46438

CVE-2025-46438: Stored XSS in GTDB Guitar Tuners (warmwhisky) affecting versions n/a–4.2.2. Root cause is improper input neutralization during web page generation. CVSS v3.1 base score 6.5 (Network, Low to Moderate impact per document; user interaction required). Connected sources indicate no pub...

CVE-2025-46536

CVE-2025-46536 affects the WordPress plugin Carousel-of-post-images up to version 1.07, caused by improper input neutralization during web page generation, enabling DOM-based XSS. Public details in initial and connected sources confirm the affected software and XSS nature; no patched version is c...

GitLab 16.7 < 17.9.7 / 17.10 < 17.10.5 / 17.11 < 17.11.1 (CVE-2025-0639)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

CVE-2025-3904

Vulnerability in Drupal Sportsleague.This issue affects Sportsleague:...

CBL Mariner 2.0 Security Update: libsoup (CVE-2025-32913)

The version of libsoup installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-32913 advisory. - A flaw was found in libsoup, where the soupmessageheadersgetcontentdisposition function is vulnerable to a...

Security Bulletin: Vulnerability in libsoup library (CVE-2024-52531) affects Power HMC.

Summary The libsoup library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-52531 DESCRIPTION: GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in...

CVE-2025-28121

code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting XSS in feedback.php via the "q" parameter allowing remote attackers to execute arbitrary code...

AlmaLinux 9 : libxslt (ALSA-2025:4025)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:4025 advisory. libxslt: Use-After-Free in libxslt xsltGetInheritedNsList CVE-2024-55549 Tenable has extracted the preceding description block directly from the AlmaLinux security...

Azure Linux 3.0 Security Update: ruby (CVE-2025-27220)

The version of ruby installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27220 advisory. - In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service ReDoS vulnerability exists in the...

CBL Mariner 2.0 Security Update: golang / msft-golang (CVE-2025-22871)

The version of golang / msft-golang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22871 advisory. - The net/http package improperly accepts a bare LF as a line terminator in chunked data...

FoxCMS 1.2.5 - Remote Code Execution (RCE)

Date: 2025-04-17 Exploit Title: Exploit Author: VeryLazyTech Vendor Homepage: https://www.foxcms.org/ Software Link: https://www.foxcms.cn/ Version: FoxCMS v.1.2.5 Tested on: Ubuntu 22.04, Windows Server 2019 CVE: CVE-2025-29306 Website: https://www.verylazytech.com !/bin/bash banner cat " exit 1...

WordPress JobWP plugin <= 2.3.9 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by stealthcopter in WordPress Plugin JobWP versions = 2.3.9...

CVE-2025-38575

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match aeadrequestalloc Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures sensitive crypto data is zeroed before being freed...

BELL-CVE-2024-58093

Bulletin has no description...

CVE-2025-26998

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through = 1.8...

CVE-2025-39562

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-paypal-pro allows Stored XSS.This issue affects Payment Form for PayPal Pro: from n/a through = 1.1.72...