CVE-2025-62037

CVE-2025-62037 concerns the Togo WordPress theme (versions before 1.0.4) with a Missing Authorization/Broken Access Control vulnerability. The issue stems from lack of proper authorization checks, potentially allowing unauthorized access to restricted resources. Public documents from Red Hat, ENI...

CVE-2025-62036 WordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in uxper Togo togo.This issue affects Togo: from n/a through 1.0.4...

CVE-2025-62036

CVE-2025-62036 is a Cross-Site Scripting (XSS) vulnerability affecting the WordPress theme Togo (uxper) versions prior to 1.0.4. The issue arises from improper input neutralization during web page generation. Affected product: Togo theme (

CVE-2025-62033 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through 1.0.4...

CVE-2025-62032 WordPress tagDiv Cloud Library plugin < 3.9.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through 3.9.2...

CVE-2025-62028 WordPress Salient theme < 17.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through 17.4.0...

CVE-2025-59556 WordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup GoStore gostore allows Reflected XSS.This issue affects GoStore: from n/a through 1.6.4...

CVE-2025-58964 WordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through 1.6.4...

CVE-2025-58964

CVE-2025-58964 affects the WordPress Theme Enzy (Enzy) prior to version 1.6.4, with a Reflected Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation. Public references from NVD/Red Hat/CVE records indicate the fix is to upgrade to Enzy 1.6.4 or later....

CVE-2025-58964 WordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through 1.6.4...

CVE-2025-58627 WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through 2.0.9...

CVE-2025-48090 WordPress Blanka - One Page WordPress Theme Theme < 1.5 - Local File Inclusion Vulnerability

Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through 1.5...

CVE-2025-48089 WordPress Education WordPress Theme | HiStudy theme < 3.1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histudy allows SQL Injection.This issue affects Education WordPress Theme | HiStudy: from n/a through 3.1.0...

CVE-2025-12638 affecting package keras for versions less than 3.3.3-5

CVE-2025-12638 affecting package keras for versions less than 3.3.3-5. A patched version of the package is available...

Advantech WebAccess/VPN 安全漏洞

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. Advantech WebAccess/VPN suffers from a SQL injection...

PT-2025-45246

Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through 2.0.9...

AZL-69847 CVE-2025-46784 affecting package lasso for versions less than 2.9.0-1

A denial of service vulnerability exists in the lassonodeinitfrommessagewithformat functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerabili...

Apple iOS < 18.7.2 Multiple Vulnerabilities (125633)

Binary data appleios1872check.nbin...

CVE-2025-48076 Galette is vulnerable to Cross-site Scripting

Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0...

CVE-2025-47776 MantisBT: Authentication bypass for some passwords due to PHP type juggling

Mantis Bug Tracker MantisBT is an open source issue tracker. Due to incorrect use of loose == instead of strict === comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instanc...