PT-2025-48163

In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the internal index during the addition of new “Data Security Accounts“. The vulnerability would require either local access to the log files or administrative access to internal indexe...

CVE-2025-62731 Stored XSS in SOPlanning

SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. By default only administrators and users with special privileges...

CVE-2025-65094

CVE-2025-65094 affects WBCE CMS prior to 1.6.4. A low-privileged user can escalate to Administrators by manipulating the groups[] parameter in the /admin/users/save.php request. UI prevents selection of other groups, but server-side validation is missing, allowing overwriting of group membership ...

IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering

Summary ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference IDOR vulnerabilities that allow authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Impact ZITADEL's Organization V2Beta API,...

Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure (cisco-sa-roomos-inf-disc-qGgsbxAm)

According to its self-reported version, Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure is affected by a vulnerability. - A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint CE and Cisco RoomOS Software could allow an...

CVE-2025-10051

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

PT-2025-41684

Name of the Vulnerable Software and Affected Versions WP Scraper plugin for WordPress versions prior to 5.8.2 Description The WP Scraper plugin for WordPress is susceptible to Server-Side Request Forgery SSRF in versions up to and including 5.8.1. This flaw resides within the wp scraper extract...

EUVD-2018-11726

Malware in sbrugna...

EUVD-2025-31141

Malicious code in bioql PyPI...

CVE-2025-9516

The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'customlog' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to view the contents of files outside of the original...

PT-2025-36349

Name of the Vulnerable Software and Affected Versions AdForest WordPress Theme versions prior to 6.1.0 Description The AdForest theme for WordPress is susceptible to an authentication bypass, allowing unauthorized user access. The theme does not properly verify a user’s identity before...

CVE-2024-8393 Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion

The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary...

CVE-2025-4798

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with...

CVE-2019-12863

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 allows Stored HTML Injection by administrators via the Web Console Settings screen...

PT-2025-9820

Name of the Vulnerable Software and Affected Versions WP Real Estate Manager plugin for WordPress versions prior to 2.9 Description The issue is related to insufficient identity verification on the LinkedIn login request process, allowing unauthenticated attackers to bypass official authenticatio...

D-Link DSL6740C 操作系统命令注入漏洞

The D-Link DSL6740C is a wireless VDSL router from China's AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability, which can be exploited by a remote attacker with administrator privileges to inject and execute arbitrary system commands via specific...

PT-2024-37803 · WordPress · Wp Mail Smtp

Name of the Vulnerable Software and Affected Versions: WP Mail SMTP plugin for WordPress versions up to, and including, 4.0.1 Description: The issue allows authenticated attackers with administrative-level access and above to view the SMTP password for the supplied server when viewing the setting...

WordPress WP Total Branding plugin <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via title Parameter vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin WP Total Branding versions = 1.2...

CVE-2024-3073

The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possibl...

PT-2024-18307 · WordPress · Wp Smtp

Name of the Vulnerable Software and Affected Versions: WP SMTP plugin for WordPress versions 1.2 to 1.2.6 Description: The issue allows authenticated attackers with administrator-level access and above to perform SQL Injection via the search parameter due to insufficient escaping on the...