CVE-2025-47053

creationtimestamp| type| source ---|---|--- 2025-07-16 16:25:57+00:00| seen| Telegram/FCXOHuThxMTRBjgPl0SexKFmmhTcaJNuto-RlzveXKlTzI...

CVE-2025-53929

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarcor.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

CVE-2025-53936

WeGIA is vulnerable to a Reflected XSS in the personalizacao_selecao.php endpoint via the nome_car parameter on versions prior to 3.4.5. The issue arises from insufficient input filtering/escaping, enabling injection of malicious scripts. Version 3.4.5 fixes the vulnerability. Remediation: upgrad...

CVE-2025-53936 WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `nome_car`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the personalizacaoselecao.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers...

CVE-2025-40918

Authen::SASL::Perl::DIGESTMD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, i...

CVE-2025-40776

creationtimestamp| type| source ---|---|--- 2025-07-16 13:33:58+00:00| seen| https://bsky.app/profile/isc.org/post/3lu3jsy4gus2e 2025-07-16 13:55:32+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114863251883486606 2025-07-16 22:07:10+00:00| seen|...

CVE-2025-40923

CVE-2025-40923 affects Plack-Middleware-Session for Perl prior to 0.35, where the default session id generator uses a SHA-1 hash seeded with rand, epoch time, and PID, making session IDs predictable. Fedora advisory notes a fix to version 0.36, using Crypt::SysRandom for secure session IDs. The v...

CVE-2025-7656

creationtimestamp| type| source ---|---|--- 2025-07-16 12:17:24+00:00| seen| https://vulnerability.circl.lu/bundle/b205087a-783f-4a89-b594-104ef807c79c 2025-07-16 13:22:59+00:00| seen| https://t.me/truesecator/7238 2025-07-16 19:21:24+00:00| seen|...

CVE-2025-47652 WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through = 2.13.4...

CVE-2025-54047

CVE-2025-54047 concerns the WordPress plugin Cost Calculator. The initial description identifies a missing authorization issue due to incorrectly configured access control levels, affecting versions up to and including 7.4. Connected sources corroborate a broken access control vulnerability for t...

CVE-2025-53990

CVE-2025-53990 is a deserialization-based PHP Object Injection vulnerability in WordPress plugin JetFormBuilder (versions

CVE-2025-27465

Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up an...

CVE-2025-7359

The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitorgetblock function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-6977 ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pmgetmessengernotification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2025-49833

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py openslice function. sliceoptroot and slice-inp-path takes user input, which is passed to the openslice function, which concatenates the use...

CVE-2025-30761

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...

CVE-2025-53905

Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successful...

CVE-2025-53101

creationtimestamp| type| source ---|---|--- 2025-07-15 20:54:08+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3ltzrx5bng22c 2025-09-03 10:44:23+00:00| seen| https://gist.github.com/Darkcrai86/24595b707ace2c372c45b92ba82b3f98...

CVE-2025-30761

...

CVE-2025-30754

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0....