PT-2025-9134 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions prior to 1.2.0 Description: The issue concerns the backup restore functionality, which is vulnerable to path traversal in the TAR entry's name. This allows an attacker to overwrite any file on the system with their content,...

PT-2025-8922 · WordPress · Login Me Now

Name of the Vulnerable Software and Affected Versions: Login Me Now plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is related to insecure authentication based on an arbitrary transient name in the AutoLogin::listen function, allowing unauthenticated attackers to...

Mastodon 授权问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. An authorization issue vulnerability exists in Mastodon that stems from an unapproved user being able to view the reason for a domain block, affecting instance administrators who do not wish to make...

CVE-2024-13634

The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-8673 · WordPress · Post Timeline Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Post Timeline WordPress plugin versions prior to 2.3.10 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-8675

Name of the Vulnerable Software and Affected Versions WP Pricing Table WordPress plugin version 1.1 Description The issue is related to a Reflected Cross-Site Scripting problem. This occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

CVE-2024-10545

The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

PT-2025-7403 · WordPress · Mambo Importer

Name of the Vulnerable Software and Affected Versions: Mambo Importer plugin for WordPress versions up to, and including, 1.0 Description: The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input via the data parameter in the fImportMenu...

CVE-2024-13900

The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments...

WordPress Bit Assist plugin <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function vulnerability

Path Traversal to Authenticated Administrator+ Arbitrary File Read via downloadResponseFile Function vulnerability discovered by koffee in WordPress Plugin Bit Assist versions = 1.5.2...

Synology Active Backup for Business 路径遍历漏洞

Synology Active Backup for Business is a backup program from Synology, a Chinese company. A path traversal vulnerability exists in Synology Active Backup for Business, which could allow a remote authenticated user with administrator privileges to delete arbitrary files via unspecified vectors...

Synology Active Backup for Business 路径遍历漏洞

Synology Active Backup for Business is a backup program from Synology, a Chinese company. A path traversal vulnerability exists in Synology Active Backup for Business, which can be exploited to allow a remote authenticated user with administrator privileges to read specific files containing...

Q-Free MAXTIME Suite 访问控制错误漏洞

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. An access control error vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions, which stems from a lack of authentication for critical functions in maxprofile/accounts/routes.lua. An...

WordPress Simple add pages or posts plugin <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Pham Van Tam in WordPress Plugin Simple Add Pages or Posts versions = 2.0.0...

CVE-2022-46303

Command injection in SMS notifications in Tribe29 Checkmk = 2.1.0p10, Checkmk = 2.0.0p27, and Checkmk = 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local...

CVE-2025-20204

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE guest portals could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities are due to insufficient validation of...

CVE-2024-2449

A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF paylo...

PT-2025-2112

Name of the Vulnerable Software and Affected Versions iBuildApp WordPress plugin versions 0.2.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be...

WordPress WP All Import plugin <= 3.7.9 - Authenticated (Administrator+) PHP Object Injection via Import File vulnerability

Authenticated Administrator+ PHP Object Injection via Import File vulnerability discovered by ? in WordPress Plugin WP All Import versions = 3.7.9...

CVE-2025-22219

VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that can perform stored cross-site scripting may lead to arbitrary operations as admin user...