5811 matches found
WordPress Testimonial Carousel For Elementor plugin <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Testimonial Carousel For Elementor versions = 11.6.2...
Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)
The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update CPU. It is, therefore, affected by: - Vulnerability in Oracle Essbase component: Security and Provisioning Bouncy Castle Java Library. The supported version that is...
NewStart CGSL MAIN 7.02 : python-setuptools Vulnerability (NS-SA-2025-0253)
The remote NewStart CGSL host, running version MAIN 7.02, has python-setuptools packages installed that are affected by a vulnerability: - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex ...
CVE-2025-9981 Multiple Stored XSS in QuickCMS
QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality sliders-form. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. T...
PT-2025-43527
Name of the Vulnerable Software and Affected Versions FontForge version 20230101 Description A memory leak exists in FontForge through the DlgCreate8 component. The issue involves a memory leak, potentially leading to resource exhaustion. Recommendations At the moment, there is no information abo...
CVE-2025-58963
CVE-2025-58963 affects WordPress Medcity theme (versions prior to 1.1.9). The Red Hat and NVD entries, EUVD/ENISA records, and CVE listings consistently describe an unrestricted upload of files with dangerous types in the Medcity plugin/theme, enabling upload of a Web Shell to the web server. Roo...
CVE-2025-49929 WordPress Ultimate Blocks plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows Stored XSS.This issue affects Ultimate Blocks: from n/a through = 3.3.6...
CVE-2025-49916 WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through = 4.2.23...
aiomysql 安全漏洞
aiomysql is a MySQL access library from aio-libs open source. A security vulnerability exists in aiomysql versions prior to 0.3.0, which stems from an unchecked client-side setting that could lead to a malicious server obtaining arbitrary client-side files...
CVE-2025-62480
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Naming Subsystem. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit...
CVE-2025-8053 Insufficient access control vulnerability has been discovered in Opentext Flipper.
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API without sufficient privileges. This issue affects Flipper: 3.1....
Tomcat-2017-CVEs
It is an exploit module/toolkit targeting Apache Tomcat. The vul...
CVE-2025-36730
Windsurf/Windsurft CVE-2025-36730 is a prompt-injection vulnerability affecting Windsurf/Windsurft version 1.10.7 when operating in Write mode with the SWE-1 model. The issue arises from a crafted file name that becomes appended to the user prompt, causing Windsurf to follow its instructions. Doc...
CVE-2025-11629 RainyGao DocSys getUserList.do getUserList sql injection
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vend...
Reachable Assertion
Overview Affected versions of this package are vulnerable to Reachable Assertion in the handshake phase. An attacker can cause the client to crash by sending a premature HANDSHAKEDONE frame. Remediation Upgrade github.com/quic-go/quic-go to version 0.49.1, 0.54.1 or higher. References - GitHub PR...
EUVD-2025-33666
Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory...
EUVD-2025-33669
Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data...
CVE-2025-10635
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks...
SourceCodester Hotel and Lodge Management System 代码问题漏洞
SourceCodester Hotel and Lodge Management System is a SourceCodester open source hotel and lodge management system. A code issue vulnerability exists in SourceCodester Hotel and Lodge Management System version 1.0 and earlier, which stems from incorrect manipulation of the parameter...