CVE-2025-47947

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case in stable released versions: when the payload's content type is application/json, and there is at...

CVE-2008-0940

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407...

CVE-2006-6625

Cross-site scripting XSS vulnerability in mod/forum/discuss.php in Moodle 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the navtail parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2025-2261 TIBCO BPM Enterprise XSS Vulnerability

Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application...

CVE-2025-2261

CVE-2025-2261 is a Stored XSS in TIBCO ActiveMatrix Administrator affecting TIBCO BPM Enterprise. The vulnerability arises when user input is stored in a data store and later rendered without proper filtering, allowing malicious data to appear as part of the website and run in a user’s browser wi...

CVE-2025-4008

The CVE-2025-4008 vulnerability affects Smartbedded Meteobridge prior to 6.2. The web interface processes input in template.cgi (unsanitized query-string data passed to eval), enabling unauthenticated remote attackers to execute arbitrary commands with root privileges, risking full device comprom...

PT-2025-22418 · Tibco · Tibco Activematrix Administrator

Name of the Vulnerable Software and Affected Versions: TIBCO ActiveMatrix Administrator affected versions not specified Description: The issue allows malicious data to appear as part of the website and run within a user's browser under the privileges of the web application. This is due to a Store...

ModSecurity 安全漏洞

ModSecurity is an open source, cross-platform web application firewall WAF engine from OWASP ModSecurity Open Source. A security vulnerability exists in ModSecurity version 2.9.8 and earlier that stems from a potential denial of service when processing application/json content types...

The vulnerability in the XMLRPC software of the UserGate Next-Generation Firewall (NGFW), a unified management center called the UserGate Management Center (UGMC), the UserGate Log Analyzer (LogAn) system for log collection, the UserGate Security Information and Event Management (SIEM) system, and the UserGate Web Application Firewall (WAF) allows attackers to disclose protected information.

The vulnerability of the XMLRPC software on the UserGate Next-Generation Firewall NGFW, as well as the UserGate Management Center UGMC and the UserGate Log Analyzer LogAn system, is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to...

ModSecurity -- Possible DoS Vulnerability

[email protected] reports: ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case in stable released versions: when the payload's content...

CVE-2025-44896

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the webaclbindEditpost function...

CVE-2025-44893

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the webaclmgmtRulesApplypost function...

CVE-2025-44893

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the webaclmgmtRulesApplypost function...

CVE-2025-44896

FW-WGS-804HPT v1.305b241111 contains a stack overflow in the web_acl_bindEdit_post function triggered via the bindEditMACName parameter. This is the exact root cause noted across sources; CVSSv3.1 base score is 9.8 (CRITICAL) with network attack vector, low complexity, no user interaction, and im...

CVE-2025-44896

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the webaclbindEditpost function...

PT-2026-6292

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.59.32 Description Langroid is a framework used for building applications powered by large-language-models. A weakness exists in the TableChatAgent component where the Web Application Firewall WAF can be bypassed...

CVE-2025-44886

Affected product: Planet FW-WGS-804HPT, version 1.305b241111. Vulnerability: stack overflow in the function web_acl_mgmt_Rules_Edit_postcontains, triggered by the byruleEditName parameter due to improper input validation. Impact (as described): potential arbitrary code execution or denial of serv...

WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Free Shipping Bar: Amount Left for Free Shipping for WooCommerce versions = 2.4.6...

PT-2025-21976 · Woocommerce · Pektsekye Year Make Model Search

Name of the Vulnerable Software and Affected Versions: Pektsekye Year Make Model Search for WooCommerce versions 1.0.11 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into...

MCP Guardian: a Security-First Layer for Safeguarding MCP-Based AI System

As Agentic AI gain mainstream adoption, the industry invests heavily in model capabilities, achieving rapid leaps in reasoning and quality. However, these systems remain largely confined to data silos, and each new integration requires custom logic that is difficult to scale. The Model Context...