CVE-2025-9519 Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode

The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and...

CVE-2025-9518 atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion

The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debugpath' parameter in all versions up to, and including, 1.2.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete...

CVE-2025-9518

CVE-2025-9518 covers the atec Debug WordPress plugin (versions ≤ 1.2.22). The flaw is insufficient validation of the debug_path parameter, enabling authenticated users with Administrator+ rights to arbitrarily delete files (e.g., wp-config.php). This could facilitate remote code execution. The Wo...

CVE-2025-58161

MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute pat...

CVE-2025-57263

An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST parameter in the words.php admin panel...

CVE-2025-57263

An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST parameter in the words.php admin panel...

PT-2025-35906

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: An authenticated Path Traversal vulnerability exists in the /apprain/common/download/ endpoint. This allows remote users to bypass SecurityManager restrictions and download arbitrary files if they posses...

CVE-2025-57263

VX Guestbook version 1.07 is affected by an authenticated SQL injection vulnerability. Attackers with admin access can inject malicious SQL payloads by exploiting the "word" POST parameter within the words.php admin panel . The practical consequence is the ability to execute arbitrary SQL command...

CVE-2025-20287

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based...

CVE-2025-20287

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based...

CVE-2025-20270

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of reques...

CVE-2025-20287 Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based...

CVE-2025-20270

CVE-2025-20270 affects Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure. The issue is an information disclosure caused by improper validation of API endpoint requests in the web-based management interface. An authenticated, low-privileged user could remotely exploi...

CVE-2025-56498

An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit...

CVE-2025-9378 Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-9378

CVE-2025-9378 concerns the WordPress plugin Vayu Blocks – Website Builder for the Block Editor (versions up to 1.3.9). The vulnerability is a Stored Cross-Site Scripting issue in the Lottie block, arising from insufficient input sanitization and output escaping. An authenticated attacker with Con...

CVE-2025-58163

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vulnerability that allows authenticated attackers with knowledge of the application's APPKEY to achieve remote code execution. The...

PT-2025-35807

Name of the Vulnerable Software and Affected Versions Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure affected versions not specified Description A vulnerability exists in the web-based management interface that could allow an authenticated, remote attacker to condu...

Linux Distros Unpatched Vulnerability : CVE-2021-21325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befor...

CVE-2025-9260

CVE-2025-9260 relates to Fluent Forms for WordPress, where versions 5.1.16–6.1.1 are vulnerable to PHP Object Injection via parseUserProperties, enabling an authenticated Subscriber+ to deserialize untrusted input. A POP chain allows reading arbitrary files, potentially exposing sensitive data (e...