KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Luka XSS w TheGem umożliwia atakującym wykonanie skryptów w przeglądarkach użytkowników.
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.
Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.
Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.
Luka XSS w Envision Page Builder umożliwia atakującemu wykonanie skryptów w przeglądarce użytkownika.
Nieprawidłowe neutralizowanie danych wejściowych w Speaker umożliwia atak XSS.
Wstrzyknięcie skryptów w SupportCandy umożliwia atak XSS typu Stored.
Luka XSS w Spacetime Ad Inserter pozwala na wykorzystanie niewłaściwie skonfigurowanych poziomów dostępu.
Wstrzyknięcie skryptów w WoowBot umożliwia atak typu Stored XSS.
Wstrzyknięcie skryptów w Author Box WP Lens umożliwia atak XSS typu Stored.
Wstrzyknięcie skryptów w wpdesk Flexible Refund umożliwia atak XSS.
Wykorzystanie XSS w reCAPTCHA dla Asgaros Forum pozwala na ataki DOM-Based XSS.
Wykorzystanie XSS w motywie Phlox umożliwia atakującemu wykonanie złośliwego kodu w przeglądarce.
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash.
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.
Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles…
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job…
Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30. |
Do wiadomości | 6,5 | 0,22 % | ||
| Luka XSS w TheGem umożliwia atakującym wykonanie skryptów w przeglądarkach użytkowników. | Luka XSS w TheGem umożliwia atakującym wykonanie skryptów w przeglądarkach użytkowników. |
Do wiadomości | 6,5 | 0,22 % | ||
| Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions. | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions. |
Do wiadomości | 6,5 | 0,22 % | ||
| Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions. | Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions. |
Do wiadomości | 6,5 | 0,22 % | ||
| Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. | Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. |
Do wiadomości | 6,5 | 0,22 % | ||
| Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions. | Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions. |
Do wiadomości | 6,5 | 0,22 % | ||
| Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions. | Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions. |
Do wiadomości | 6,5 | 0,22 % | ||
| Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions. | Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions. |
Do wiadomości | 6,5 | 0,22 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3. |
Do wiadomości | 6,5 | 0,22 % | ||
| Luka XSS w Envision Page Builder umożliwia atakującemu wykonanie skryptów w przeglądarce użytkownika. | Luka XSS w Envision Page Builder umożliwia atakującemu wykonanie skryptów w przeglądarce użytkownika. |
Do wiadomości | 6,5 | 0,22 % | ||
| Nieprawidłowe neutralizowanie danych wejściowych w Speaker umożliwia atak XSS. | Nieprawidłowe neutralizowanie danych wejściowych w Speaker umożliwia atak XSS. |
Do wiadomości | 6,5 | 0,22 % | ||
| Wstrzyknięcie skryptów w SupportCandy umożliwia atak XSS typu Stored. | Wstrzyknięcie skryptów w SupportCandy umożliwia atak XSS typu Stored. |
Do wiadomości | 6,5 | 0,22 % | ||
| Luka XSS w Spacetime Ad Inserter pozwala na wykorzystanie niewłaściwie skonfigurowanych poziomów dostępu. | Luka XSS w Spacetime Ad Inserter pozwala na wykorzystanie niewłaściwie skonfigurowanych poziomów dostępu. |
Do wiadomości | 6,5 | 0,22 % | ||
| Wstrzyknięcie skryptów w WoowBot umożliwia atak typu Stored XSS. | Wstrzyknięcie skryptów w WoowBot umożliwia atak typu Stored XSS. |
Do wiadomości | 6,5 | 0,22 % | ||
| Wstrzyknięcie skryptów w Author Box WP Lens umożliwia atak XSS typu Stored. | Wstrzyknięcie skryptów w Author Box WP Lens umożliwia atak XSS typu Stored. |
Do wiadomości | 6,5 | 0,22 % | ||
| Wstrzyknięcie skryptów w wpdesk Flexible Refund umożliwia atak XSS. | Wstrzyknięcie skryptów w wpdesk Flexible Refund umożliwia atak XSS. |
Do wiadomości | 6,5 | 0,22 % | ||
| Wykorzystanie XSS w reCAPTCHA dla Asgaros Forum pozwala na ataki DOM-Based XSS. | Wykorzystanie XSS w reCAPTCHA dla Asgaros Forum pozwala na ataki DOM-Based XSS. |
Do wiadomości | 6,5 | 0,22 % | ||
| Wykorzystanie XSS w motywie Phlox umożliwia atakującemu wykonanie złośliwego kodu w przeglądarce. | Wykorzystanie XSS w motywie Phlox umożliwia atakującemu wykonanie złośliwego kodu w przeglądarce. |
Do wiadomości | 6,5 | 0,22 % | ||
| CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version… | CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash. |
Do wiadomości | 6,5 | 0,22 % | ||
| Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. |
Do wiadomości | 6,5 | 0,22 % | ||
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by… | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization. |
Do wiadomości | 6,5 | 0,22 % | ||
| Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a… | Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,22 % | ||
| Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and… | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles… |
Do wiadomości | 6,5 | 0,22 % | ||
| In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles… | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job… |
Do wiadomości | 6,5 | 0,22 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes… |
Do wiadomości | 6,5 | 0,22 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.