EUVD-2025-33237

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on th...

CVE-2025-7526

CVE-2025-7526 affects WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress (versions

CVE-2025-7634: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on th...

CVE-2025-7526: Improper Limitation of a Pathname to a Restricted Directory

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion via renaming due to insufficient file path validation in the setuserprofileimage function in all versions up to, and including, 6.6.7. This makes it possible for...

EUVD-2020-17047

Malware in sbrugna...

EUVD-2019-6698

Malware in sbrugna...

EUVD-2024-21012

Malicious code in bioql PyPI...

EUVD-2025-22981

Malicious code in bioql PyPI...

EUVD-2025-6403

Malicious code in bioql PyPI...

EUVD-2025-3526

Malicious code in bioql PyPI...

EUVD-2024-48706

Malicious code in bioql PyPI...

EUVD-2024-49171

Malicious code in bioql PyPI...

EUVD-2024-48090

Malicious code in bioql PyPI...

EUVD-2024-50875

Malicious code in bioql PyPI...

EUVD-2025-24787

Malicious code in bioql PyPI...

EUVD-2025-24788

Malicious code in bioql PyPI...

EUVD-2022-33781

Malicious code in bioql PyPI...

EUVD-2024-45690

Malicious code in bioql PyPI...

CVE-2025-6941: Improper Neutralization of Input During Web Page Generation

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepointresources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escapin...

CVE-2025-6815: Improper Neutralization of Input During Web Page Generation

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘servicename’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for...