2025

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to,

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts whe

The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' p

Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows netwo

MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability

A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown p

The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxap

A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the S

Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary c

A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2. Affected by this vulnerability is an unk

Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `e

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affect

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO a

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Cre

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality

A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inj

Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitr

A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual

A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network

A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manip

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthent

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authentica

The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the C

The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

The ns_backup extension through 13.0.0 for TYPO3 allows command injection.

The cs_seo extension through 9.2.0 for TYPO3 allows XSS.

The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.

A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classifie

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning va

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4B

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_p

AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.

The certificate and private key used for providing transport layer security for connections to the web interface (TCP po

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The

The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader

The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all v

The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_yo

The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts

The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_don

The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ param