CVE-2025-7665

The CVE-2025-7665 entry concerns Miniorange OTP Verification with Firebase for WordPress, affecting versions 3.1.0–3.6.2. A missing capability check in the handle_mofirebase_form_options function enables unauthenticated privilege escalation to Administrator. Exploitation is described as requiring...

CVE-2025-7665 Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

CVE-2025-8463 IDOR in SecHard Information Technologies' SecHard

Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805...

CVE-2025-8463

The CVE-2025-8463 entry maps to an authorization bypass in Nebula Informatics SecHard (SecHard) prior to version 3.6.2-20250805, caused by user-controlled key manipulation that bypasses authorization controls (parameter injection risk noted in PT-2025-38148). Affected component appears to be the ...

PT-2025-38148

Name of the Vulnerable Software and Affected Versions Nebula Informatics SecHard versions prior to 3.6.2-20250805 Description An authorization bypass issue exists in Nebula Informatics SecHard due to a parameter injection vulnerability. This issue allows an attacker with low privileges to bypass...

Advisory ROSA-SA-2025-2975

Software: libarchive 3.6.2 OS: ROSA-CHROME unaffected versions = libarchive-3.6.2-6 affected versions libarchive-3.6.2-6 CVE-ID: CVE-2025-5914 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability has been discovered in libarchive archivereadformatrarseekdata related to an integer overflow that...

CVE-2025-4390

The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validaterestrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted...

CVE-2025-4390

The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validaterestrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted...

CVE-2025-4390 WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure

The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validaterestrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted...

PT-2025-31054 · Prettier · Prettier

Name of the Vulnerable Software and Affected Versions: prettier versions up to 3.6.2 Description: A vulnerability exists in prettier due to inefficient regular expression complexity within the parseNestedCSS function of the src/language-css/parser-postcss.js file. The manipulation of the node...

CVE-2024-5263

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-32820

Missing Authorization vulnerability in Social Share Pro Social Share Icons & Social Share Buttons.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.6.2...

CVE-2023-30872

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2...

CVE-2023-1607

A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2023-2039

A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10=0ℴ=desc. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

CVE-2020-11014

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the...

Backdrop CMS 跨站脚本漏洞

Backdrop CMS is a content management system CMS from Backdrop CMS open source. A cross-site scripting vulnerability exists in Backdrop CMS versions prior to 1.x-3.6.2, which stems from a failure to validate a tagged link before performing a tagged operation, which could lead to a cross-site...

CVE-2025-46229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Israpil Textmetrics allows Stored XSS. This issue affects Textmetrics: from n/a through 3.6.2...

CVE-2025-46229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Israpil Textmetrics webtexttool allows Stored XSS.This issue affects Textmetrics: from n/a through = 3.6.2...