EUVD-2025-50768

Malicious code in aboveparakeetz3n npm...

EUVD-2025-50771

Malicious code in aboveflamingoz3n npm...

EUVD-2025-50769

Malicious code in aboveostrichz3n npm...

CVE-2025-10635

The Find Me On WordPress plugin (versions through 2.0.9.1 ) contains a SQL injection vulnerability due to a failure to properly sanitize and escape a parameter before its use in a SQL statement. This flaw allows users with subscriber privileges or higher to execute arbitrary SQL commands, which c...

EUVD-2021-9345

Malicious code in bioql PyPI...

CVE-2025-8282: Undefined Security Weakness

The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks...

CVE-2025-22427

In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

PT-2025-33495 · Unknown · Xolluteon Dropshix

Name of the Vulnerable Software and Affected Versions: Xolluteon Dropshix versions through 4.0.14 Description: Improper neutralization of input during web page generation allows for DOM-Based Cross-site Scripting XSS. Recommendations: Update Xolluteon Dropshix to a version later than 4.0.14...

Linux Distros Unpatched Vulnerability : CVE-2024-35988

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASKSIZE on 64-bit NOMMU On NOMMU, userspace memory can come from...

PT-2025-33162 · WordPress · Thank You Page Customizer For Woocommerce – Increase Your Sales

Name of the Vulnerable Software and Affected Versions: VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales versions through 1.1.7 Description: A missing authorization issue exists in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales, allowing...

CVE-2022-24784

Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire...

PT-2025-12859

Name of the Vulnerable Software and Affected Versions The Spectra – WordPress Gutenberg Blocks plugin versions up to, and including, 2.19.0 Description The issue is related to Stored Cross-Site Scripting via the uagb block due to insufficient input sanitization and output escaping. This allows...

PT-2025-12736

Name of the Vulnerable Software and Affected Versions DesignThemes Core Features plugin for WordPress versions up to, and including, 4.8 Description The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-11030

Name of the Vulnerable Software and Affected Versions: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution plugin for WordPress versions up to, and including, 3.1.0 Description: The issue is related to a Stored DOM-Based Cross-Site Scripting...

PT-2025-10414

Name of the Vulnerable Software and Affected Versions The SlingBlocks – Gutenberg Blocks by FunnelKit Formerly WooFunnels plugin for WordPress versions up to, and including, 1.5.0 Description The issue is related to Stored Cross-Site Scripting via the "Icon List" Block due to insufficient input...

PT-2025-10042

Name of the Vulnerable Software and Affected Versions Wishlist plugin for WordPress versions up to, and including, 1.0.43 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wishlist button shortcode. This allows authenticated...

PT-2025-7193

Name of the Vulnerable Software and Affected Versions: Post Thumbs versions n/a through 1.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-1621

Name of the Vulnerable Software and Affected Versions Eventer plugin for WordPress versions up to, and including, 3.9.9 Description The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allow...

CVE-2025-0471

The CVE-2025-0471 entry concerns PMB platform unrestricted file upload allowing remote access and command execution. Affected versions include 4.0.10 and later (CNNVD cites up to 4.2.13). The underlying issue is unrestricted file upload in PMB platform, enabling an attacker to upload a file to ga...

CVE-2025-0471 Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform

Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to gain remote access to the machine, being able to access, modify and execute commands freely...