CVE Vulnerability Catalog

Podatność CVE-2025-8463 dotyczy SecHard Information Technologies i pozwala na ominięcie autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia wymuszone przeglądanie. Problem ten dotyczy wersji SecHard przed 3.6.2-20250805.

A SQL injection vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0 in mysearch.php, where the search_field/search_text arguments are improperly handled, allowing remote attacks.

Podatność CVE-2025-0879 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w aplikacji Shopside, co umożliwia ataki typu Cross-Site Scripting (XSS). Wymaga ona wysokich uprawnień do wykorzystania.

The Sydney theme for WordPress (all versions up to and including 2.56) lacks a capability check on the 'activate_modules' function. Authenticated attackers with Subscriber-level access or higher can activate or deactivate theme modules.

Podatność CVE-2025-0546 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu MevzuatTR, co prowadzi do możliwości ataków XSS, phishingu, nakładania iFrame, clickjackingu oraz wymuszonego przeglądania. Wymaga to wysokich uprawnień.

A Cross-Site Scripting (XSS) vulnerability was discovered in Portabilis i-Educar up to version 2.10 in the file /intranet/educar_usuario_det.php. By manipulating the ref_pessoa argument, an attacker can inject malicious script. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.

W Paraşüt Software występuje podatność na Cross-Site Scripting (XSS) spowodowana niewłaściwą neutralizacją danych wejściowych podczas generowania stron internetowych. Problem dotyczy wersji od 0.0.0.65efa44e do 20250204.

Podatność CVE-2025-0419 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w Zirve Nova, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji od 235 do 20250131.

The Media Player Addons for Elementor plugin for WordPress version 1.0.5 is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_artist_name' parameters. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

A CWE-428 vulnerability exists in the UPS management application from OMRON SOCIAL SOLUTIONS, where Windows service executable paths are not enclosed in quotation marks. If the installation path contains spaces, unauthorized files may be executed with service privileges.

The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.0.4 due to missing or incorrect nonce validation on the bulk_remove() function. This allows unauthenticated attackers to delete arbitrary directories in /wp-content via a forged request.

The Memberlite Shortcodes plugin for WordPress (all versions up to and including 1.4) is vulnerable to stored Cross-Site Scripting via the 'row' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts.

The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the uss_setting_page function when processing the uss_set form type. Unauthenticated attackers can modify critical Upyun cloud storage settings including bucket name, operator credentials, upload paths, and image processing parameters via a forged request if they trick a site administrator into clicking a link.

The Productive Style plugin for WordPress up to version 1.1.23 is vulnerable to Stored Cross-Site Scripting via the display_productive_breadcrumb shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

A Cross-Site Scripting (XSS) vulnerability exists in NEC Corporation UNIVERGE IX (versions from 9.5 to 10.7, from 10.8.21 to 10.8.36, from 10.9.11 to 10.9.24, from 10.10.21 to 10.10.31, 10.11.6) and UNIVERGE IX-R/IX-V (versions 1.3.16, 1.3.21). An attacker can inject arbitrary scripts that may be executed in the user's browser.

The Social Media Shortcodes plugin for WordPress up to version 1.3.1 is vulnerable to Stored Cross-Site Scripting via the 'twitter' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_loggers parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

A stored XSS vulnerability in the search-autootaxi.php endpoint of the ATSMS web application. Improper input sanitization allows injection of arbitrary JavaScript, which is stored and executed when the report page is accessed.

The Human Resource Integrated System 1.0 by code-projects is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section, specifically in the Childs Name field. This allows an attacker to inject malicious scripts that may execute in the administrator's browser.