Archive
January 2025
Vulnerabilities first published in this month (UTC), newest first.
2,209 results · Clear filters · Feed
-
Medium 4.4
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker title value of the Google Maps block in all versions up to, and including, 5.0.9 due to insufficient inp…
-
Medium 4.3
VIWIS LMS File Upload cross site scripting
A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Upload. The manipulation of the argument filename leads to cross site scripting. The attack can be…
-
Medium 4.3
VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)
VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network.
-
Medium 6.4
Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happy Mouse Cursor in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping.…
-
Medium 4.3
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contr…
-
Medium 6.4
Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget in all versions up…
-
Medium 6.1CVE-2024-12585 Scanner template
PropertyHive < 2.1.1 - Reflected XSS
The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
Medium 5.4
Auto iFrame < 2.0 - Contributor+ XSS via Shortcode
The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cr…
-
Medium 5.3
InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files …
-
Medium 6.5
MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and l…
-
Medium 6.4
Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for…
-
Medium 4.8
Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to t…
-
Medium 6.2
Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause fea…
-
Medium 6.8
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successf…
-
Medium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successf…
-
Medium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successf…
-
Medium 6.8
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successf…
-
Medium 6.4
Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versi…
-
Medium 5.3
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for…
-
Medium 6.4
Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti-embed-ga' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attrib…
-
Medium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successf…
-
Medium 6.3
Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may …
-
Medium 6.6
Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affe…
-
Medium 6.7
Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulne…
-
Medium 4.0
Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vul…
-
Medium 4.3
Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulne…
-
Medium 5.3
TXOne Networks Portable Inspector Management Program Improper Input Validation Vulnerability
Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by restarting the managem…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 4.1
Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerabili…
-
Medium 5.5
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vu…
-
Medium 4.1
Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect serv…
-
Medium 6.2
Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may c…
-
Medium 6.0
Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerab…
-
Medium 5.7
Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of …
-
Medium 6.5
Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulne…
-
Medium 6.5
Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A re…
-
Medium 4.4
Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.2
Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affe…
-
Medium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…