CVE-2025-58051

CVE-2025-58051 affects Nextcloud Tables. Prior to versions 0.7.6, 0.8.8, and 0.9.5, the app allowed a user importing a table to specify server files; if the file format is supported by PhpSpreadsheet, the file content could be leaked to the user via path traversal. This is a server-side disclosur...

EUVD-2025-34758

Cross site scripting XSS vulnerability in Ultimate PHP Board 2.2.7 via the uname parameter in lostpassword.php...

CVE-2025-41018

SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'...

CVE-2025-41018

The CVE-2025-41018 entry details a SQL injection in Sergestec’s Exito v8.0. The vulnerability is reachable via the cat parameter in /public.php, allowing an attacker to retrieve, create, update, and delete databases. Connected sources (Red Hat, NVD, CVE lists, ENISA/EUVD) corroborate the same des...

EUVD-2025-34736

SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'...

CVE-2025-11746

The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theetajaxrequiredpluginspopup function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

CVE-2025-61539

Cross site scripting XSS vulnerability in Ultimate PHP Board 2.2.7 via the uname parameter in lostpassword.php...

CVE-2025-61540

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

CVE-2025-61539

CVE-2025-61539 describes a Cross-Site Scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 exploited via the u_name parameter in lostpassword.php. Affected software: Ultimate PHP Board 2.2.7. The vulnerability is triggered through input in the lostpassword.php page’s u_name parameter, enabli...

Ultimate PHP Board 安全漏洞

Ultimate PHP Board is a message board software from PHP Outburst open source. A security vulnerability exists in Ultimate PHP Board version 2.2.7, which stems from an unvalidated username field in lostpassword.php and could lead to a SQL injection attack...

CVE-2025-61539

Cross site scripting XSS vulnerability in Ultimate PHP Board 2.2.7 via the uname parameter in lostpassword.php...

Sergestec Exito SQL注入漏洞

Sergestec Exito is a sales platform from Sergestec. A SQL injection vulnerability exists in Sergestec Exito version 8.0, which stems from incorrect manipulation of the parameter cat in the file /public.php, which could lead to a SQL injection attack...

CVE-2025-61540

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

Ultimate PHP Board 安全漏洞

Ultimate PHP Board is a message board software from PHP Outburst open source. A security vulnerability exists in Ultimate PHP Board version 2.2.7, which stems from improper handling of the uname parameter in the lostpassword.php file, which could lead to a cross-site scripting attack...

CVE-2025-61540

CVE-2025-61540 : The Red Hat, NVD, OSV, EUVD, NVD (and other) records all describe a SQL injection in Ultimate PHP Board version 2.2.7, exploitable via the username field in lostpassword.php. The underlying issue is an unvalidated/unsafely assembled username input leading to SQL injection, with C...

PrestaShop Checkout 安全漏洞

PrestaShop Checkout is an open source checkout payment module from PrestaShopCorp. A security vulnerability exists in PrestaShop Checkout versions prior to 4.4.1 and prior to 5.0.5, which stems from an incorrect use of the PHP arraysearch function and could lead to PayPal merchant account hijacki...

CVE-2025-11722

The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2025-11692 Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the...

CVE-2025-11692 Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the...

CVE-2025-11722

The CVE CVE-2025-11722 affects the WordPress plugin “Woocommerce Category and Products Accordion Panel” (accordion-panel-for-category-and-products). The vulnerability is Local File Inclusion via the categoryaccordionpanel shortcode in all versions up to 1.0, exploitable by authenticated attackers...