2025

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks jet-tricks allows Retrieve Embed

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu jet-menu allows Retrieve Embedded

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor jet-elements all

Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path T

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embed

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi

Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows C

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in numixtech Page Tra

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox

Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configure

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify

Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Noti

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Infility Infility Global

The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi

URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, a

Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control

Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be

A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments

During the brief window between installation and the first administrator login, remote attackers may exploit the default

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user

A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of

A vulnerability was identified in neurobin shc up to 4.0.3. This issue affects the function make of the file src/shc.c.

A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src

Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14

A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack.

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. T

Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially result

Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the conten

Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the cont

Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and all

The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitra

A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_pack

nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engine

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ow

An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5

Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q

A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects un

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the conte

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when vis

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimiza