CVE-2025-3470

The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and including, 2.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2025-16486

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can obtain users' emails by knowing their usernames, as a password reset email will be sent in response to an unsolicited request. Recommendations At the moment,...

PT-2025-16493 · Growatt · Cloud Portal

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An attacker can obtain information about the groups of smart home devices for arbitrary users, referred to as "rooms". Recommendations: At the moment, there is no information about a newer...

CVE-2025-3100

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

CVE-2025-2719

The Swatchly – WooCommerce Variation Swatches for Products product attributes: Image swatch, Color swatches, Label swatches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdismiss function in versions 1.2.8 to 1.4.0. This makes ...

CVE-2025-2805

The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-0539

CVE-2025-0539 affects Octopus Deploy on Windows where the server can be coerced into issuing server-side requests that include authentication material. The underlying impact is that a suitably positioned attacker could compromise the account running the Octopus Server and potentially affect the h...

CVE-2025-20946

Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prior to SMR Apr-2025 Release 1 allows local attackers to pair with specific bluetooth devices without user interaction...

CVE-2025-29870

Affected product: Wi-Fi AP UNIT AC-WPS-11ac series from Inaba Denki Sangyo. CVE-2025-29870 describes a Missing authentication for critical function vulnerability that could allow a remote unauthenticated attacker to obtain the device configuration information, including authentication details. Th...

CVE-2025-30291

Adobe ColdFusion CVE-2025-30291 affects ColdFusion 2023.12, 2021.18, 2025.0 and earlier and is described as an Information Exposure vulnerability that could bypass security features. The NVD/CVE data indicate a local attacker with low privileges and no user interaction could access sensitive info...

CVE-2025-31332

Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this...

CVE-2025-20947

Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access image files across multiple users. User interaction is required for triggering this vulnerability...

CVE-2025-20940

Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider in SDMHS...

CVE-2025-20940

Samsung Device Health Manager Service (SDMHS) on affected Samsung devices is impacted by CVE-2025-20940 due to improper handling of insufficient permissions, enabling local attackers to access the SDMHS provider. CVSS v3.1 base score 4.0 (Medium) with local attack vector, no confidentiality impac...

CVE-2025-20940

Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider in SDMHS...

CVE-2025-2525 Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'stAuthenticationController::editprofile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above...

Microsoft Azure 日志信息泄露漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A log information disclosure vulnerability exists in Microsoft Azure. An attacker exploiting this vulnerability could gain access to sensitive information...

PT-2025-15337 · Unknown · Clipboardservice

Name of the Vulnerable Software and Affected Versions: ClipboardService versions prior to 1 Description: The issue is related to the improper handling of insufficient permission or privileges in ClipboardService. This allows local attackers to access files with system privilege. User interaction ...

Siemens Industrial Edge Device Kit

SUMMARY Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge Device Builders integrate Industrial Edge Device Kit into their offerings...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from South Korea's Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Apr-2025 Release 1, which originates from an out-of-bounds read when parsing audi...