CVE-2025-3515 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

RHEL 7 : libsoup (RHSA-2025:9179)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9179 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: Heap buffer over-read in...

ZendTo 路径遍历漏洞

ZendTo is a Web-based file transfer system from ZendTo, a UK-based company. A security vulnerability exists in ZendTo versions 6.15-7 and earlier, which stems from a path traversal in the file drop feature that could lead to retrieval of other user files or host system files, or cause a denial of...

WordPress plugin Integration for Contact Form 7 and Zoho CRM, Bigin 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

PT-2025-25707 · Unknown · Integration For Contact Form 7/Zoho Crm

Name of the Vulnerable Software and Affected Versions: Integration for Contact Form 7 and Zoho CRM, Bigin versions 1.3.0 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This is a problem where an application deserializes data from...

RHEL 7 : ipa (RHSA-2025:9189)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9189 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based...

AZL-64121 CVE-2025-49795 affecting package libxml2 for versions less than 2.11.5-7

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...

WordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.3.0 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Frissi0n in WordPress Plugin Integration for Contact Form 7 and Zoho CRM, Bigin versions = 1.3.0...

RHEL 7 : firefox (RHSA-2025:9074)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:9074 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

CVE-2025-5952

A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclos...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2025-20372)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20372 advisory. - net/mlx5e: Fix NULL deref in mlx5etirbuilderalloc Elena Salomatkina Orabug: 37206299,37670859 CVE-2024-50000 - net/mlx5: Fix error path in...

CVE-2025-30399

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network...

AZL-63798 CVE-2025-47712 affecting package nbdkit for versions less than 1.35.3-7

A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service...

RHEL 7 : perl-FCGI (RHSA-2025:8625)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8625 advisory. FastCGI Perl bindings. Security Fixes: perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fc...

Oracle Linux 7 : python-jinja2 (ELSA-2025-1250)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-1250 advisory. 2.7.2-4.0.1 - Fix for CVE-2024-56326 Orabug: 37576737 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. No...

RHEL 7 : python-tornado (RHSA-2025:8664)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8664 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

CVE-2025-24772

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

CVE-2025-24772

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

CVE-2025-24772

CVE-2025-24772 describes a CSRF vulnerability in cmsMinds Pay with Contact Form 7 (Pay with Contact Form 7: from n/a through 1.0.4). The connected Red Hat entry confirms the CSRF issue but provides no additional technical details or patch information beyond the description, so no remediation deta...

CVE-2025-24772 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...