CVE-2025-53691

CVE-2025-53691 is a Sitecore vulnerability: insecure deserialization in Sitecore Experience Manager (XM) and Experience Platform (XP) can lead to Remote Code Execution (RCE). Affected: XM 9.0–9.3 and 10.0–10.4; XP 9.0–9.3 and 10.0–10.4. Root cause: untrusted data deserialization using insecure pa...

CVE-2025-48109

Cross-Site Request Forgery CSRF vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through = 0.9.1...

CVE-2025-48109 WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Xavier Media XM-Backup allows Stored XSS. This issue affects XM-Backup: from n/a through 0.9.1...

CVE-2025-48109 WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through = 0.9.1...

CVE-2025-48109

CVE-2025-48109 is a CSRF to Stored XSS vulnerability in the WordPress plugin XM-Backup, affecting versions up to and including 0.9.1. The vulnerability allows an attacker to coerce a logged-in user to perform actions that trigger a stored XSS payload, per the CVE description and Patchstack/PT-202...

WordPress plugin XM-Backup 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2025-34991

Name of the Vulnerable Software and Affected Versions: Xavier Media XM-Backup versions through 0.9.1 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Xavier Media XM-Backup, which also allows Stored Cross-Site Scripting XSS. Recommendations: Update Xavier Media XM-Backup to ...

Linux Distros Unpatched Vulnerability : CVE-2019-14380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files. CVE-2019-14380 Note that Nessus relies on the presence ...

WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin XM-Backup versions = 0.9.1...

Sitecore XM/XP/XC Hardcoded Credentials

Sitecore XM, XP and XC version 9.x = 9.3 or version 10.x 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP. No source data...

CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Sitecore Experience Manager XM, Experience Platform XP, and Experience Commerce XC versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing...

CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Sitecore Experience Manager XM, Experience Platform XP, and Experience Commerce XC versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing...

CVE-2025-34509 Sitecore XM and XP Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

[SECURITY] Fedora 41 Update: xen-4.19.2-3.fc41

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

CVE-2020-28393

An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 All versions prior to v6.4...

CVE-2019-15558

XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java...

CVE-2019-14380

libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files...

CVE-2019-15557

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2008-5923

SQL injection vulnerability in default.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands the cat parameter...

CVE-2006-6750

Format string vulnerability in XM Easy Personal FTP Server 5.0.1 allows remote attackers to cause a denial of service application crash via format string specifiers in a long PORT command. NOTE: this issue might be related to CVE-2006-2226...