devolo dLAN Cockpit 代码问题漏洞

devolo dLAN Cockpit is a powerline communications network management software from German company devolo. A code issue vulnerability exists in devolo dLAN Cockpit version 4.3.1, which stems from a service path misconfiguration and could lead to the execution of arbitrary code...

CVE-2025-62120 WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through = 4.3.1...

CVE-2025-62120

CVE-2025-62120 documents a Cross-Site Request Forgery (CSRF) vulnerability in the OpenHook thesis-openhook component, affecting OpenHook versions up to and including 4.3.1. The description specifies CSRF as the issue and lists the affected product as OpenHook, but the Connected Documents do not p...

CVE-2025-62120 WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rick Beckman OpenHook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through 4.3.1...

JD Cloud多款产品 安全漏洞

JD Cloud BE6500 and others are products of the Chinese company Jingdong JD.JD Cloud BE6500 is a WiFi router.JD Cloud AX1800 is an edge computing router.JD Cloud AX3000 is an edge computing router. A security vulnerability exists in several JD Cloud products that stems from the presence of an...

CVE-2025-13956

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders...

CVE-2025-13956 LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders...

PT-2025-51366

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions prior to 4.3.2 Description The LearnPress – WordPress LMS Plugin is susceptible to unauthorized data access because of a missing capability check within the statistic function. This allows...

CVE-2025-14387

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2025-14387 LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2025-67507

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect...

CVE-2025-67507 Filament's multi-factor authentication (app) recovery codes can be used multiple times

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect...

CVE-2025-67507

CVE-2025-67507 affects Filament versions 4.0.0 through 4.3.0. The vulnerability arises in the handling of app-based multi-factor authentication recovery codes, allowing the same recovery code to be reused indefinitely when recovery codes are enabled (email-based MFA is unaffected). Root cause: im...

CVE-2025-67507 Filament's multi-factor authentication (app) recovery codes can be used multiple times

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect...

CVE-2025-63024 WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through = 4.3.1...

PT-2025-49901

Name of the Vulnerable Software and Affected Versions Opal WP ekommart versions prior to 4.3.1 Description A flaw exists in Opal WP ekommart that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue impacts the software’s handling of...

📄 eGovFramework 4.3.1 Arbitrary File Upload

eGovFramework version 4.3.1 proof of concept exploit that demonstrates an arbitrary file upload vulnerability. ============================================================================================================================================= | Title : eGovFramework 4.3.1 Unauthenticate...

CVE-2025-34336 eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints

eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints. These controllers accept multipart requests without authentication, pass the...

egovframe-common-components 安全漏洞

egovframe-common-components is a collection of commonly used functions open-sourced by the e-Government Standard Framework Center. A security vulnerability exists in egovframe-common-components version 4.3.1 and earlier, which stems from a design flaw in symmetric encryption that could lead to an...

PT-2025-45052

Name of the Vulnerable Software and Affected Versions Xibo versions 4.3.0 and below Description Xibo is a digital signage platform with a web content management system CMS. Versions 4.3.0 and below contain a Remote Code Execution issue in the CMS Developer menu’s Module Templating functionality...