CVE-2025-0134 Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM...

CVE-2025-3623 Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function

The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automatorapidecodemessage function. This makes it possible for unauthenticated to inject a PHP Object. The additional presen...

CVE-2025-4520 Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to...

CVE-2024-29222

Out-of-bounds write for some IntelR Graphics Driver software may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-31150

Out-of-bounds read for some IntelR Graphics Driver software may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2025-20031

Improper input validation for some IntelR Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-35281

An improper isolation or compartmentalization vulnerability CWE-653 in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variabl...

CVE-2025-3107 Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby' parameter in all versions up to, and including, 4.9.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

Zoom Workplace Apps for Windows Null Pointer Dereference Vulnerability

Zoom Workplace Apps for Windows is the official suite of collaboration tools from Zoom, including core features such as team chat, whiteboards, notes, and more, available through a Zoom Meetings account. A null pointer dereference vulnerability exists in Zoom Workplace Apps for Windows, which can...

CVE-2025-46748

CVE-2025-46748 describes an authenticated user being able to change their password without providing the current password. Multiple connected sources confirm the issue and reference affected Schweitzer Engineering Laboratories products (e.g., SEL-5033 acSELerator RTAC software, SEL-5702, SEL-5035...

SVG Sanitization Bypass

october/october is vulnerable to SVG sanitization bypass. The vulnerability is due to insufficient validation of file types, allowing authenticated users to bypass SVG sanitization by uploading files with permitted extensions and renaming them to .svg...

Dropbear 2024.84 - 2025.88 Privilege Escalation Vulnerability

Dropbear is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Exploit for CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE Exploit CRITI...

CVE-2025-3878 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's saverify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3876 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with...

CVE-2025-2158

CVE-2025-2158 : WordPress Review Plugin (The Ultimate Solution for Building a Review Website) is reported vulnerable to Local File Inclusion via Post custom fields in versions up to 5.3.5. Exploitation requires authenticated access at Contributor level or higher; successful exploitation could all...

CVE-2025-1137 IBM Storage Scale command injection

IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization...

CVE-2025-3476

Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This issue affects Operations Bridge Manager: 2023.05, 23.4, 24.2, 24.4...

CVE-2025-3468

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cleanhtml and formfields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it...

WordPress plugin Contest Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...