CVE Vulnerability Catalog

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Anubis, a Web AI Firewall Utility, prior to version 1.23.0 did not validate the redirect URL when using subrequest authentication, allowing redirection to any URL scheme. While most modern browsers block redirects to `javascript:` URLs, it could still trigger dangerous behavior in some cases. The issue is fixed in version 1.23.0.

Bitplatform Boilerplate, a Visual Studio and .NET project template, versions prior to 9.11.3 are affected by a cross-site scripting (XSS) vulnerability in WebInteropApp/WebAppInterop, potentially allowing attackers to inject malicious scripts that compromise the security and integrity of web applications. Version 9.11.3 fixes the issue.

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

A vulnerability in kdcproxy allows an attacker to perform a DoS attack by sending unbounded data in a KDC response, causing excessive memory and CPU usage. The lack of TCP response length validation and inefficient buffer management can overwhelm the server even with a single request.

A vulnerability in the Linux kernel related to the use of smp_processor_id() in preemptible code has been fixed. The bug report concerned a warning generated by dhcpcd, indicating improper use of this function in a preemptible context.

A vulnerability in Spectrum Power 4 (versions before V4.70 SP12 Update 2) allows modification of the local database containing application credentials. This enables an attacker to gain administrative privileges.

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

Podatność CVE-2025-11960 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie KVKNET firmy Aryom Software High Technology Systems Inc. Umożliwia to ataki typu Reflected XSS.

A 3rd-party component exposed its password in process arguments, allowing low-privileged users to access it.

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

The Make Email Customizer for WooCommerce WordPress plugin through version 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.

The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 1.0.0. This is due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or above can inject arbitrary web scripts that execute when a user accesses the SVG file.

The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.