Explore CVE records

HighPublished 12 Apr 2025, 08:32 WIB

CVE-2025-29803

Visual Studio Tools for Applications and SQL Server Management Studio Elevation of Privilege Vulnerability

Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record

MedPublished 12 Apr 2025, 06:21 WIB

CVE-2025-2269

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CritPublished 12 Apr 2025, 05:25 WIB

CVE-2025-0129

Prisma Access Browser: Inappropriate control behavior in Prisma Access Browser

An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy Rules. This enables the user to use Prisma Access Browser without any restrictions.

Excerpt language: en.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 Jun 2025, 03:50 WIB

Official record

MedPublished 12 Apr 2025, 01:21 WIB

CVE-2024-11679

An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory.

Excerpt language: en.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated12 Apr 2025, 01:46 WIB

Official record

MedPublished 12 Apr 2025, 00:43 WIB

CVE-2025-0123

PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures

A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-custom-packet-capture in decrypted HTTP/2 data streams traver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated12 Apr 2025, 01:36 WIB

Official record

MedPublished 12 Apr 2025, 00:37 WIB

CVE-2025-0119

Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM

A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges on the host operating system running Broker VM.

Excerpt language: en.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated12 Apr 2025, 02:00 WIB

Official record

MedPublished 11 Apr 2025, 23:25 WIB

CVE-2025-32077

XSSes in Extension:SimpleCalendar

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:33 WIB

Official record

MedPublished 11 Apr 2025, 23:24 WIB

CVE-2025-32078

XSSes and potential RCE in Special:VersionCompare

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:34 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:24 WIB

CVE-2025-32079

Saving the right content to MediaWiki:GrowthMentors.json can take down the site

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:17 WIB

Official record

MedPublished 11 Apr 2025, 23:24 WIB

CVE-2025-32080

Cross-origin data leak in mobilefrontend via lazy load images

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:36 WIB

Official record

MedPublished 11 Apr 2025, 23:23 WIB

CVE-2025-32076

Evil regex used to process user-provided data in VisualData

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:39 WIB

Official record

MedPublished 11 Apr 2025, 23:23 WIB

CVE-2025-32072

HTML injection in feed output from i18n message

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:53 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:22 WIB

CVE-2025-32073

System message XSS in HTMLTags

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML Tags: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:09 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:22 WIB

CVE-2025-32074

XSSes in Extension:ConfirmAccount

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:29 WIB

Official record

MedPublished 11 Apr 2025, 23:21 WIB

CVE-2025-32075

IP and user agent leaks in Extension:Tabs

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Apr 2025, 00:34 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:21 WIB

CVE-2025-32067

i18n XSS vulnerability in message growthexperiments

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Growth Experiments Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:33 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:21 WIB

CVE-2025-32068

Revoking authorization of OAuth2 consumer does not invalidate refresh tokens

Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:28 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:20 WIB

CVE-2025-32069

Wikitext stored XSS on filepages due to dangerous WBMI serialization

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:09 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:20 WIB

CVE-2025-32070

XSSes in AJAXPoll

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:31 WIB

Official record

UnscoredPublished 11 Apr 2025, 23:19 WIB

CVE-2025-32071

Wikibase CommonsInlineImageFormatter: i18n XSS

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message via ImageHandler::getDimensionsString()This issue affects Mediawiki - Wikidata Extension: from 1.39 through 1.43.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2025, 21:17 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage