7267 matches found
CVE-2025-3261
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-3261
CVE-2025-3261 entry is rejected/not used as stated; it does not represent an active vulnerability.
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via widget URLs in the skywalking-ui component. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious content into stored data that is later rendered in the web...
PT-2025-48282
Name of the Vulnerable Software and Affected Versions ThingsBoard versions prior to 4.2.1 Description An authenticated user can upload malicious SVG images through the "Image Gallery". This leads to a Stored Cross-Site Scripting XSS issue. The exploit is triggered when any user accesses the publi...
Cross-site Scripting (XSS)
Liferay is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied input in multiple fields within the Notifications widget, which allows an attacker to inject malicious scripts via crafted payloads and execute them in a victim’s browser...
CVE-2025-13386
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...
CVE-2025-13386 Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...
EUVD-2025-199574
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...
CVE-2025-13386
CVE-2025-13386 affects the WordPress plugin Social Images Widget (WordPress) up to version 2.1. The issue is a missing capability check in the options_update function, enabling unauthenticated attackers to delete or modify the plugin’s settings via a forged request and social engineering (trickin...
CVE-2025-13386 Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...
EUVD-2025-199375
Malicious code in @voiceflow/widget npm...
MAL-2025-191387 Malicious code in @voiceflow/widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac19bf504aadbfdca19efac5f7d258c14c541a1f9747324e00da8220b0b1d785 The package @voiceflow/widget was found to contain malicious code. Source: google-open-source-security...
WordPress Social Images Widget plugin <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Social Images Widget versions = 2.1...
PT-2025-48010
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...
WordPress plugin Social Images Widget 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
Malicious code in @ensdomains/renewal-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 727920a0b3da80ce1061cf9557e1d3ef72a90618523b692406438b7150061dad The package @ensdomains/renewal-widget was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190735 Malicious code in @ensdomains/renewal-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 727920a0b3da80ce1061cf9557e1d3ef72a90618523b692406438b7150061dad The package @ensdomains/renewal-widget was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-198743
Malicious code in @ensdomains/renewal-widget npm...
WordPress ArtPlacer Widget plugin <= 2.22.9.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin ArtPlacer Widget versions = 2.22.9.2...