PT-2025-38775

Name of the Vulnerable Software and Affected Versions Automattic Developer versions n/a through 1.2.6 Description A Cross-Site Request Forgery CSRF issue exists in Automattic Developer. This allows attackers to perform actions on behalf of an authenticated user without their knowledge...

WordPress plugin Automattic Developer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

PYSEC-2025-143

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd...

MoneyPrinterTurbo 安全漏洞

MoneyPrinterTurbo is a software by Harry's personal developer that generates short HD videos using AI macromodels. A security vulnerability exists in MoneyPrinterTurbo version 1.2.6, which stems from a path traversal issue in the /api/v1/download/ URI that could lead to accessing sensitive files...

CVE-2025-49089

CVE-2025-49089 affects wangxutech MoneyPrinterTurbo 1.2.6 with a path traversal flaw in the /api/v1/download/ endpoint (e.g., /api/v1/download//etc/passwd) that could disclose sensitive files. Details across sources confirm the vulnerability title and affected version; the root cause is an improp...

CVE-2025-49089

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd...

MoneyPrinterTurbo 路径遍历漏洞

MoneyPrinterTurbo is a software by Harry's personal developer that generates short HD videos using AI macromodels. A path traversal vulnerability exists in MoneyPrinterTurbo 1.2.6 and earlier versions, which stems from a misuse of the parameter filepath in the file app/controllers/v1/video.py,...

CVE-2025-49089

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd...

BIT-ENVOY-GATEWAY-2025-24030 Envoy Admin Interface Exposed through prometheus metrics endpoint

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

WordPress Hogwords Theme <= 1.2.6 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Hogwords versions = 1.2.6...

WordPress Hogwords Theme <= 1.2.6 is vulnerable to Local File Inclusion

Software Hogwords Type Theme Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ee13435740c8 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-58644

Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.This issue affects LTL Freight Quotes - TQL Edition: from n/a through = 1.2.6...

CVE-2025-58836

CVE-2025-58836 concerns the FW Anker WordPress plugin (Tikolan FW Anker) vulnerable to Stored XSS due to improper input neutralization during web page generation. Affected versions are FW Anker up to 1.2.6 (and earlier per sources). Public records indicate the vulnerability is not yet patched in ...

CVE-2025-58836 WordPress FW Anker Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Franz Wieser FW Anker fw-anker allows Stored XSS.This issue affects FW Anker: from n/a through = 1.2.6...

CVE-2025-58836 WordPress FW Anker Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Franz Wieser FW Anker fw-anker allows Stored XSS.This issue affects FW Anker: from n/a through = 1.2.6...

WordPress FW Anker Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Mika in WordPress Plugin FW Anker versions = 1.2.6...

CVE-2025-56435

SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on the parameter id...

PT-2025-36175

Name of the Vulnerable Software and Affected Versions: Tikolan FW Anker versions through 1.2.6 Description: The software contains an Improper Neutralization of Input During Web Page Generation vulnerability, which allows for Stored Cross-site Scripting XSS. Recommendations: Update Tikolan FW Anke...

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.

...

WordPress LTL Freight Quotes - TQL Edition Plugin <= 1.2.6 - PHP Object Injection Vulnerability

WordPress LTL Freight Quotes - TQL Edition Plugin = 1.2.6 - PHP Object Injection Vulnerability discovered by mcdruid in WordPress Plugin LTL Freight Quotes - TQL Edition versions = 1.2.6...