WordPress plugin Interactive US Map 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-3436

CVE-2025-3436 affects the WordPress plugin “coreActivity: Activity Logging for WordPress.” The vulnerability is an SQL injection in the query built from user-supplied parameters order and orderby, impacting all versions up to and including 2.7. Exploitation requires authentication at Subscriber l...

CVE-2025-3436 coreActivity: Activity Logging for WordPress <= 2.7 - Authenticated (Subscriber+) SQL Injection

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

PT-2025-14904 · Unknown · Elunez Eladmin

Name of the Vulnerable Software and Affected Versions: elunez eladmin version 2.7 Description: A problematic issue has been found in the Maintenance Management Module, affecting some unknown functionality of the file "/api/database/testConnect". This issue leads to deserialization and can be...

Debian dla-4082 : libruby2.7 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4082 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4082-1 [email protected]...

DLA-4082-1 ruby2.7 - security update

Bulletin has no description...

PT-2025-8917 · WordPress · Templines Elementor Helper Core +1

Name of the Vulnerable Software and Affected Versions: Templines Elementor Helper Core plugin for WordPress versions up to, and including, 2.7 Description: The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation due to allowing arbitrary user meta updates...

DLA-4018-2 ruby2.7 - regression update

Bulletin has no description...

CVE-2025-25125

Cross-Site Request Forgery CSRF vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through = 3.1...

CVE-2025-25125 WordPress Fyrebox Quizzes plugin <= 2.7 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in CyrilG Fyrebox Quizzes allows Stored XSS. This issue affects Fyrebox Quizzes: from n/a through 2.7...

CVE-2025-25125

CVE-2025-25125 concerns a CSRF to stored XSS vulnerability in WordPress plugin Fyrebox Quizzes (CyrilG) affecting versions from n/a up to 2.7. The CVE is tracked in multiple feeds; the vulnerability is confirmed in WordPress/Fyrebox Quizzes context and is rated 7.1 ( HIGH ) by CVSS 3.1 with netwo...

CVE-2025-25125 WordPress Fyrebox Quizzes plugin <= 3.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through = 3.1...

PT-2025-2014 · WordPress · Social Share Buttons

Name of the Vulnerable Software and Affected Versions: Social Share Buttons for WordPress versions 2.7 and earlier Description: The issue allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded. Recommendations: For Social Share Buttons for WordPress...

Ubuntu: Security Advisory (USN-7180-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress plugin BeBetter Social Icons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Python Execute Command

Execute an arbitrary OS command. Compatible with Python 2.7 and 3.4+. Module Options msf use payload/python/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options ...show and set options... msf payloadexec run module MetasploitModule CachedSize =...

CVE-2024-51242

A Server-Side Request Forgery SSRF vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF...

CVE-2024-10546

The CVE-2024-10546 entry concerns open-scratch Teaching 在线教学平台 (versions up to 2.7). The vulnerability exists in the URL Handler’s API endpoint /api/sys/ng-alain/getDictItemsByTable/ and is due to an SQL injection in that API. It is exploitable remotely and an exploit has been disclosed publicly....

CVE-2024-51242

Summary: CVE-2024-51242 affects ELADMIN (eladmin) 2.7 and earlier, with a Server-Side Request Forgery (SSRF) caused by manipulating the HTTP Body parameter named ip in ServerDeployController.java. The vulnerability enables potential unauthorized network access from the affected system, as reflect...

CVE-2024-51242

A Server-Side Request Forgery SSRF vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF...