PT-2025-5525 · Wow Company · Wow-Company Popup Box

Name of the Vulnerable Software and Affected Versions: Wow-Company Popup Box versions 3.2.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 3.2.4 and...

WordPress plugin Counter Box 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

PT-2025-5529 · Wow Company · Counter Box

Name of the Vulnerable Software and Affected Versions: Wow-Company Counter Box versions 2.0.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's behalf. Recommendations: For versions 2.0.5 and...

CVE-2025-24715: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through = 2.0.5...

WordPress plugin Popup Box 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

Palo Alto Firewalls Found Vulnerable to Secure Boot Bypass and Firmware Exploits

An exhaustive evaluation of three firewall models from Palo Alto Networks has uncovered a host of known security flaws impacting the devices' firmware as well as misconfigured security features. "These weren't obscure, corner-case vulnerabilities," security vendor Eclypsium said in a report share...

Malicious code in @chkpkit/box (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis be611a64a4693f32ee325101273c6edec5fc7c62e14b8455d75bb5014f2a0379 The OpenSSF Package Analysis project identified '@chkpkit/box' @ 99.99.93 npm as malicious. It is considered malicious because: - The package...

CVE-2025-23938

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through = 1.0.3...

CVE-2025-23938

CVE-2025-23938 affects Image Gallery Box by CRUDLab (WordPress plugin). Red Hat and WordPress vulnerability data describe an Authenticated Local File Inclusion (LFI) caused by improper handling of filename includes in PHP, enabling access to local files via NotFound Image Gallery Box pages. Affec...

CVE-2025-23938 WordPress Image Gallery Box by CRUDLab Plugin <= 1.0.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through = 1.0.3...

PT-2025-5216 · Crudlab · Image Gallery Box

Name of the Vulnerable Software and Affected Versions: Image Gallery Box by CRUDLab versions n/a through 1.0.3 Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

WordPress plugin Image Gallery Box by CRUDLab 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2025-23938: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through = 1.0.3...

CVE-2025-22706

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0...

CVE-2025-22318

Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through = 1.6.13...

CVE-2025-22706 WordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0...

CVE-2025-22706

CVE-2025-22706 describes a reflected Cross-Site Scripting vulnerability in the Social Pug: Author Box component of Social Pug. The root cause is improper neutralization of input during web page generation, enabling reflected XSS. Affected product: Social Pug: Author Box (Social Pug) with versions...

CVE-2025-22706 WordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0...

WordPress plugin Social Pug: Author Box 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Social Pug: A cross-site...

PT-2025-4638

Name of the Vulnerable Software and Affected Versions Social Pug: Author Box versions prior to 1.0.0 Description The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject malicious script...