CVE Vulnerability Catalog

The Piotnet Forms WordPress plugin has a Cross-Site Request Forgery (CSRF) vulnerability that allows CSRF attacks. This affects all versions up to and including 1.0.30.

The Double the Donation plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.0.0.

The AnyClip Luminous Studio plugin (anyclip-media) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.3.3.

The Epeken All Kurir WordPress plugin is vulnerable to Stored XSS (Cross-Site Scripting) due to improper input neutralization during web page generation. The issue affects versions up to and including 2.0.6.

The WP Compress plugin (wp-compress-image-optimizer) for WordPress has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This affects versions up to 6.50.54.

A Cross-Site Scripting (XSS) vulnerability was discovered in the ARD meal reservation service. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that executes in the user's browser.

The AffiliateWP – External Referral Links WordPress plugin is vulnerable to Stored XSS due to improper input neutralization. The issue affects versions up to and including 1.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS. This issue affects Goracash: from n/a through <= 1.1.

A Cross Site Scripting vulnerability was found in PivotX CMS version 3.0.0 RC 3. This flaw allows a remote attacker to execute arbitrary JavaScript code via the subtitle field.

SQL Injection vulnerability in ARD GEC en Lign software before version 2025-04-23 allows a remote attacker to escalate privileges via GET parameters in index.php.

Podatność CVE-2025-9035 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w platformie Virtual Library firmy Horato Internet Technologies Ind. And Trade Inc., co pozwala na ataki typu Reflected XSS.

W podatności CVE-2025-8079 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w oprogramowaniu Smart Trade E-Commerce, co pozwala na ataki typu Reflected XSS. Problem dotyczy wersji przed 4.5.0.0.1.

Podatność CVE-2025-0875 dotyczy systemu OBS (System Informacji o Sprawach Studenckich) firmy PROLIZ, umożliwiając obejście autoryzacji poprzez wstrzykiwanie parametrów. Problem ten występuje w wersjach przed v26.0328.

In Artifex GhostXPS before version 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked. This can lead to crashes or potential code execution.

A vulnerability was found in h2oai h2o-3 up to version 3.46.08. The impacted element is an unknown function of the /99/ImportSQLTable file related to the IBMDB2 JDBC Driver component. Manipulation of the connection_url argument causes deserialization, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

The SKTLab Mukbee app version 1.01.196 on Android has a vulnerability in an unknown function of the AndroidManifest.xml file of the com.dw.android.mukbee component, resulting in improper export of Android application components. The attack must be initiated locally, and the exploit is now public and may be used. The vendor was contacted but did not respond.

In the Linux kernel, ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() were defined to ensure proper page table synchronization when calling p*d_populate_kernel(). The fix addresses intermittent boot failures on systems with 4-level paging and large persistent memory, as well as a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds().

A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. It affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

W podatności CVE-2025-8664 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w systemie zarządzania e-gminą StarCities, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem dotyczy wersji przed 20250825.