100,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in Anti-Malware Security and Brute-Force Firewall WordPress Plugin

On October 3rd, 2025, we received a submission for an Arbitrary File Read vulnerability in Anti-Malware Security and Brute-Force Firewall, a WordPress plugin with more than 100,000 active installations. This vulnerability makes it possible for an authenticated attacker, with subscriber-level...

Deserialization Of Untrusted Data

h2o is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper handling of JDBC connection parameters with insufficient input validation, which allows an attacker to bypass regular expression checks using double URL encoding and subsequently read arbitrary files or...

CVE-2025-60729

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function...

PerfreeBlog 安全漏洞

PerfreeBlog is PerfreeBlog open source a java-based development of the blog / CMS site building platform. PerfreeBlog 4.0.11 version of a security vulnerability , the vulnerability stems from validThemeFilePath function has an arbitrary file read problem...

EUVD-2025-35860

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function...

CVE-2025-60729

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function...

PT-2025-43662

Name of the Vulnerable Software and Affected Versions PerfreeBlog version 4.0.11 Description PerfreeBlog version 4.0.11 contains an arbitrary file read issue within the validThemeFilePath function. This allows for unauthorized access to files. Recommendations Update to a newer version that contai...

CVE-2025-60729

PerfreeBlog v4.0.11 contains an arbitrary file read vulnerability in the validThemeFilePath function. The issue is confirmed across multiple sources in the Connected documents and affects the PerfreeBlog 4.0.11 release; CVSS v3.1 base score cited as 5.3 (Medium). The exact exploit details, affect...

CVE-2025-60729

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function...

CVE-2025-60729

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function...

CVE-2025-60729

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function...

CVE-2025-58456

CVE-2025-58456 concerns AutomationDirect’s Productivity Suite, version 4.4.1.19. The Red Hat/EUVD/NVD entries and CISA advisory corroborate a relative path traversal (ZipSlip) vulnerability in ProductivityService PLC simulator, enabling an unauthenticated remote attacker to read arbitrary files o...

ChurchCRM Path Traversal Vulnerability

ChurchCRM is an open source CRM system for churches. ChurchCRM 5.18.0 and previous versions of path traversal vulnerability, the vulnerability stems from the file src/ChurchCRM/Backup/RestoreJob.php parameter restoreFile fails to correctly filter the resource or file path of the special elements,...

Unspecified Vulnerability in Newforma Project Center Server

Newforma Project Center Server is a project information management solution for the Architecture, Engineering and Construction AEC industry from Newforma for centralized storage and management of project documents and collaboration. A security vulnerability exists in Newforma Project Center Serve...

EUVD-2025-35098

Uptime Kuma Server-side Template Injection SSTI in Notification Templates Allows Arbitrary File Read...

GHSA-VFFH-C9PQ-4CRH Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...

Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...

ChurchCRM 路径遍历漏洞

ChurchCRM is an open source CRM system for churches. ChurchCRM 5.18.0 and previous versions of path traversal vulnerability, the vulnerability stems from the file src/ChurchCRM/Backup/RestoreJob.php parameter restoreFile fails to correctly filter the resource or file path of the special elements,...

CVE-2025-62424

ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - 146 and earlier, the /adminarea/templateeditor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is inadequate, allowing authenticated administrators to read and write arbitrary fil...

CVE-2025-62424 ClipBucket path traversal vulnerability in template editor allows arbitrary file read and write

ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - 146 and earlier, the /adminarea/templateeditor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is inadequate, allowing authenticated administrators to read and write arbitrary fil...