CVE-2025-6212 Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the...

CVE-2025-6212: Improper Neutralization of Input During Web Page Generation

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the...

PT-2025-26993

Name of the Vulnerable Software and Affected Versions: WIFISKY 7-layer Flow Control Router affected versions not specified Description: A remote command injection issue exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router. This is due to insufficient input validation,...

CVE-2025-34044: Improper Neutralization of Special Elements used in an OS Command

A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation eviden...

RHEL 7 : perl-File-Find-Rule-Perl (RHSA-2025:9740)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9740 advisory. This module provides methods for finding various types Perl-related files, or replicating search queries run on a distribution in various parts of th...

RHSA-2025:9582 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update

Bulletin has no description...

Oracle Linux 7 : firefox (ELSA-2025-9074)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-9074 advisory. 128.11.0-1.0.1 - Update to 128.11.0 Orabug: 38077559CVE-2025-5263CVE-2025-5264 CVE-2025-5266CVE-2025-5267CVE-2025-5268CVE-2025-5269 Tenable has extract...

Oracle Linux 7 : perl-FCGI (ELSA-2025-8625)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-8625 advisory. 1:0.74-8.0.1 - Fix CVE-2025-40907 integer overflow when parsing FastCGI parameters Orabug: 38047531 Tenable has extracted the preceding description block direct...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 (RHSA-2025:9582)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9582 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

CVE-2025-49988

Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through = 0.1.40...

RHEL 7 : libvpx (RHSA-2025:9331)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9331 advisory. The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia...

June “In the Trend of VM” (#16): vulnerabilities in Microsoft Windows, Apache HTTP Server, the web interfaces of MDaemon and Zimbra, and the 7-Zip archiver

June "In the Trend of VM" 16: vulnerabilities in Microsoft Windows, Apache HTTP Server, the web interfaces of MDaemon and Zimbra, and the 7-Zip archiver. A traditional monthly vulnerability roundup. Post on Habr rus Digest on the PT website rus A total of 7 trending vulnerabilities: Elevation of...

CVE-2025-49988 WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability

Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through = 0.1.40...

6 Steps to 24/7 In-House SOC Success

Hackers never sleep, so why should enterprise defenses? Threat actors prefer to target businesses during off-hours. That's when they can count on fewer security personnel monitoring systems, delaying response and remediation. When retail giant Marks & Spencer experienced a security event over...

PT-2025-26356 · Unknown · Renzo Contact Form 7 Aweber Extension

Name of the Vulnerable Software and Affected Versions: Renzo Contact Form 7 AWeber Extension versions 0.1.38 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

WordPress plugin Contact Form 7 AWeber Extension 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An improper access control vulnerability exists in the WordPress Contact Form 7 AWeber Extension plugin, which stems from a lack of authorization, and no detailed vulnerability...

CVE-2025-49988: Missing Authorization

Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through = 0.1.40...

WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Contact Form 7 AWeber Extension versions = 0.1.40...

CVE-2025-49330

Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through = 1.3.0...

Oracle Linux 7 : kernel (ELSA-2025-7898)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7898 advisory. - netfilter: ipset: add missing range check in bitmapipuadt Jeongjun Park CVE-2024-53141 Orabug: 37964173 Tenable has extracted the preceding description block...