CVE-2025-27353

CVE-2025-27353 describes a Cross-Site Request Forgery (CSRF) vulnerability in Namaste! LMS, affecting Namaste! LMS versions from n/a up to and including 2.6.5. The vulnerability is confirmed in multiple sources (e.g., Patchstack reference for WordPress Namaste! LMS Plugin

WordPress plugin Namaste! LMS 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2025-7766 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions 2.6.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. Recommendations: For versions 2.6.5 and earlier, update to a version that contains...

CVE-2025-24366

SFTPGo is affected by an authentication-required issue where the client-provided rsync command is not properly sanitized. An authenticated remote user could leverage certain rsync options to read or write files with the permissions of the SFTPGo server process. The vulnerability is limited to the...

GHSA-VJ7W-3M8C-6VPX SFTPGo has insufficient sanitization of user provided rsync command

Impact SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being rsync: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote...

CVE-2024-10499 AI-Engine < 2.6.5 - Admin+ SQLi

The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks...

WordPress plugin AI Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-48213

RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php...

Xinhu RockOA 安全漏洞

Xinhu RockOA is an office OA system of China Xinhu Company. A security vulnerability exists in Xinhu RockOA v2.6.5, which originates from a directory traversal issue in webmain/system/beifen/beifenAction.php...

WordPress Discount Rules for WooCommerce plugin <= 2.6.5 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Discount Rules for WooCommerce versions = 2.6.5...

PT-2024-39082 · WordPress · Discount Rules For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress versions up to, and including, 2.6.5 Description: The issue is related to Reflected Cross-Site Scripting due t...

Critical: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 2.6.5 GA ]

An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...

PT-2024-30912 · WordPress · Kevon Adonis Wp Abstracts

Name of the Vulnerable Software and Affected Versions: Kevon Adonis WP Abstracts versions 2.6.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacke...

CVE-2024-47617

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-47617 Reflected XSS Vulnerability in Sulu Media Bundle

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-47618 Sulu vulnerable to XSS via uploaded SVG

Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ other users including...

CVE-2024-47618 Sulu vulnerable to XSS via uploaded SVG

Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ other users including...

CVE-2024-47618

Sulu is a PHP content management system vulnerable to cross-site scripting (XSS) via uploaded SVG files. The issue allows a low-privilege user with access to the Media section to upload an SVG containing malicious payload, which executes in other users’ browsers when accessed. The vulnerability i...

PT-2024-32677

Name of the Vulnerable Software and Affected Versions Sulu versions 2.0.0 through 2.6.4 Description Sulu, a PHP content management system, is vulnerable to XSS attacks. A low-privileged user with access to the "Media" section can upload an SVG file containing a malicious payload. Once uploaded an...

WordPress HT Mega Plugin <= 2.6.5 is vulnerable to Sensitive Data Exposure

Software HT Mega Type Plugin Vulnerable versions = 2.6.5 Fixed in 2.6.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8910 Patch priority Low CVSS severity Low 4.3 Developer HTMega PSID 2309cc03bb5c Credits Ankit Patel Required privilege Contributor...