630 matches found
WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Meta Keywords & Description versions = 0.8...
PT-2025-17894 · WordPress · 1 Decembrie 1918
Name of the Vulnerable Software and Affected Versions: 1 Decembrie 1918 plugin for WordPress versions up to, and including, 1.dec.2012 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the "1-decembrie-1918/1-decembrie-1918.php" page...
RUSTSEC-2025-0038 Out of bounds access in public safe API
Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...
PT-2025-23365 · Crates.Io · Arrow2
Rows::row unchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...
WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover vulnerability
Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...
WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions = 2.4.37...
CVE-2025-32442
The CVE-2025-32442 issue affects Fastify (Node.js) where applications that specify different validation strategies for multiple content types can bypass validation by supplying a slightly altered Content-Type (e.g., different casing or whitespace before ";"). Affected versions include Fastify 5.0...
WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability discovered by johska Patchstack Alliance in WordPress Plugin I Draw versions = 1.0...
MAL-2025-3255 Malicious code in helper-member-expression-to-functions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e46054f993cedcc0d3d1aa68cb5224550c94097ec1d867f3d8dba501da7963f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-32783 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki
XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent i...
WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Zephyr Project Manager versions = 3.3.101...
How to Leak to a Journalist
Neiman Lab has some good advice on how to leak a story to a journalist...
WordPress RegistrationMagic plugin <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin RegistrationMagic versions = 6.0.4.3...
MAL-2025-3116 Malicious code in rif-token-contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05165c539111a84ce983abfe2dbe4cadf7b601ad72a0676be43e8c101e5fc752 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress Booster for WooCommerce plugin <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Booster for WooCommerce versions = 7.2.4...
WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin YayExtra versions = 1.5.2...
CVE-2025-2878 Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting
A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database lea...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service due to Netty (CVE-2025-25193)
Summary There is a vulnerability in the Netty library used by IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, with the grpc-1.0 or grpcClient-1.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...
CVE-2025-2598
When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....
