CVE-2025-9851 Appointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmindcalendar' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10143

CVE-2025-10143 affects the WordPress plugin Catch Dark Mode. All versions up to and including 2.0 are vulnerable to Local File Inclusion via the catch_dark_mode shortcode, allowing authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files on the server...

CVE-2025-10143 Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion

The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catchdarkmode' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on t...

CVE-2025-10166 Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-45091

Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting XSS attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities...

PT-2025-38126

Name of the Vulnerable Software and Affected Versions N-Reporter affected versions not specified N-Cloud affected versions not specified N-Probe affected versions not specified Description The N-Reporter, N-Cloud, and N-Probe developed by N-Partner are susceptible to an OS Command Injection issue...

PT-2025-38115

Name of the Vulnerable Software and Affected Versions: WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.29 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to Remote Code Execution due to the write to customfile function...

PT-2025-38097

Name of the Vulnerable Software and Affected Versions: Catch Dark Mode plugin for WordPress versions up to and including 2.0 Description: The Catch Dark Mode plugin for WordPress is susceptible to a Local File Inclusion issue via the catch dark mode shortcode. This allows authenticated attackers...

PT-2025-38107

Name of the Vulnerable Software and Affected Versions: WN-7D36QR WN-7D36QR/UE Description: An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A remote authenticated attacker may be able to execute arbitrary OS commands. Recommendations: ...

PT-2025-38122

Name of the Vulnerable Software and Affected Versions: StoreEngine versions up to and including 1.5.0 Description: The StoreEngine WordPress plugin is susceptible to a path traversal issue. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the...

PT-2025-38116

Name of the Vulnerable Software and Affected Versions: WP Import – Ultimate CSV XML Importer for WordPress plugin versions prior to 7.28 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin is susceptible to arbitrary file deletion due to inadequate file path validation...

CVE-2025-37128

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2025-37129

A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is...

CVE-2025-37123 Authenticated Command Injection leads to Unauthorized Actions in CLI Interface

A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on...

CVE-2025-37123

CVE-2025-37123 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways (CLI and Web API). The issue is described as authenticated privilege escalation via the command-line interface, allowing an attacker to run arbitrary commands with root privileges on the underlying OS. Connected sources corro...

CVE-2025-37129 Authenticated Remote Code Execution allows Exploit in Scripts Feature

A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is...

CVE-2025-37130 Unrestricted Binary allows File Enumeration in Underlying Operating System

A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system...

CVE-2025-37126 Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface

A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as...

CVE-2025-37131 Authenticated Arbitrary File Read allows Data Exposure in CLI Interface

A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information...

CVE-2025-37131 Authenticated Arbitrary File Read allows Data Exposure in CLI Interface

A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information...