CVE Vulnerability Catalog

Podatność CVE-2025-8695 dotyczy serwera NetGIS, gdzie niewłaściwe neutralizowanie danych wejściowych podczas generowania stron internetowych prowadzi do możliwości ataków typu Cross-site Scripting (XSS). Problem ten dotyczy wersji NetGIS Server od 5.2.4 do 22.08.2025.

The StoryMap plugin (wp-storymap) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 2.1.

Stored XSS vulnerability in Pushe Web Push Notification plugin up to version 0.5.0. Improper input neutralization during web page generation allows persistent injection of malicious scripts.

The Donation Forms WP by Givecloud plugin through version 1.0.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script stored in a form executes in users' browsers.

Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation. This issue affects Media Author: from n/a through <= 1.0.4.

The WordPress plugin Custom Team Manager (versions up to 2.4.2) has a Stored XSS vulnerability due to improper input neutralization during web page generation.

The WordPress plugin FW Anker (versions up to 1.2.6) has a Stored XSS vulnerability due to improper input neutralization during web page generation.

The Bonus for Woo plugin for WooCommerce contains a vulnerability related to improper validation of specified quantity in input, allowing access to functionality not properly constrained by ACLs. The issue affects versions up to and including 7.6.6.

The Parallax Scrolling Enllax.js plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.6. This vulnerability allows unauthenticated attackers to perform unwanted actions in the context of an administrator.

The WordPress plugin Parallax Scrolling Enllax.js up to version 0.0.6 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

The SoftMe theme for desertthemes has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.1.27.

The Best Restaurant Menu by PriceListo plugin through version 1.4.3 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is stored and executed in users' browsers.

The Payoneer Checkout plugin for WordPress is missing authorization, allowing content spoofing. This affects versions up to and including 3.4.0.

The WordPress plugin WPB Elementor Addons up to version 1.7 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

Missing Authorization vulnerability in the Gutentor WordPress plugin (versions up to and including 3.5.5) allows exploiting incorrectly configured access control security levels.

A permission verification vulnerability exists in the home screen module. Successful exploitation may affect availability.

Vulnerability in OceanWP WordPress theme (before 4.1.2) due to a missing capability check on one of its AJAX request handlers, allowing any authenticated users, such as subscribers, to update the 'darkMod' setting.

Weblate, a web-based localization tool, contains a vulnerability in versions before 5.13.1 that causes long session expiry during second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.

Electron contains an ASAR Integrity bypass via resource modification. This only impacts apps with the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. The issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.

Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network.