CVE-2025-6462

CVE-2025-6462 affects the WordPress plugin EZ SQL Reports Shortcode Widget and DB Backup, with a Stored Cross-Site Scripting via the SQLREPORT shortcode in all versions up to 5.25.11. Exploitation requires authenticated access at contributor level or higher. Multiple connected reports note this v...

PT-2025-27346 · WordPress · Db Backup +1

Name of the Vulnerable Software and Affected Versions: EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress versions up to, and including, 5.25.11 Description: The issue is related to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode due to insufficient input...

WordPress plugin EZ SQL Reports Shortcode Widget and DB Backup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-5015

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-53293

Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through = 1.2.3...

CVE-2025-53300 WordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode allows Stored XSS. This issue affects Podcast Feed Player Widget and Shortcode: from n/a through 2.2.0...

CVE-2025-53293 WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Dashboard Widget Sidebar: from n/a through 1.2.3...

CVE-2025-53293 WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through = 1.2.3...

WordPress plugin Podcast Feed Player Widget and Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-56915

Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting XSS via the RSS feed widget...

PT-2025-26975 · Unknown · Netbox Community

Name of the Vulnerable Software and Affected Versions: Netbox Community versions 4.1.7 through 4.2.1 Description: The issue is related to Cross Site Scripting XSS via the RSS feed widget. This allows for potential malicious script execution. Recommendations: For Netbox Community version 4.1.7,...

Netbox 安全漏洞

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in Netbox version v4.1.7, which stems from the vulnerability of the RSS feed widget to cross-site scripting attacks...

CVE-2024-56915

Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting XSS via the RSS feed widget...

CVE-2024-56915

CVE-2024-56915 affects NetBox Community from version 4.1.7, vulnerable to Cross Site Scripting via the RSS feed widget. The issue is fixed in v4.2.2; upgrade to 4.2.2 to remediate. The available sources describe the vulnerability as an XSS in the RSS feed widget, with no public exploitation detai...

CVE-2025-5015

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-5015

CVE-2025-5015 : A cross-site scripting vulnerability exists in the Parsons AccuWeather widget and the Custom RSS widget, allowing an unauthenticated user to replace the RSS feed URL with a malicious one. Concrete details across sources confirm the affected components, the attack involves injectin...

CVE-2025-5015 Parsons AccuWeather Widget Cross-site Scripting

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-5015 Parsons AccuWeather Widget Cross-site Scripting

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CISA Releases Eight Industrial Control Systems Advisories

CISA released eight Industrial Control Systems ICS advisories on June 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-175-01 Kaleris Navis N4 Terminal Operating System ICSA-25-175-02 Delta Electronics...

PT-2025-26765 · Unknown · Custom Rss Widget +1

Name of the Vulnerable Software and Affected Versions: AccuWeather and Custom RSS widget affected versions not specified Description: A cross-site scripting issue exists in the AccuWeather and Custom RSS widget, allowing an unauthenticated user to replace the RSS feed URL with a malicious one...