CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data...

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data...

CVE-2025-53327 WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in ruimashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through = 0.0.6...

CVE-2025-53320 WordPress Free Downloads EDD plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4...

CVE-2025-53257

CVE-2025-53257 affects Gmedia Photo Gallery (WordPress plugin) and is an Unauthenticated Local File Inclusion via improper control of filename for include/require in PHP. Affected versions are 1.23.0 and earlier. The vulnerability is categorized as PHP Local File Inclusion (LFI) and is reported w...

CVE-2025-53257 WordPress Gmedia Photo Gallery plugin <= 1.23.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows PHP Local File Inclusion.This issue affects Gmedia Photo Gallery: from n/a through = 1.23.0...

CVE-2025-6767 sfturing hosp_order DoctorServiceImpl.java findDoctorByCondition sql injection

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function findDoctorByCondition of the file DoctorServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. The attack...

CVE-2025-32298

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Case-Themes CTUsers ctuser allows PHP Local File Inclusion.This issue affects CTUsers: from n/a through = 1.0.0...

CVE-2025-49883

CVE-2025-49883 affects Greenmart WordPress Theme (versions

CVE-2025-4587

creationtimestamp| type| source ---|---|--- 2025-06-27 07:52:09+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19678 2025-06-27 10:37:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lslh3q6opg2o...

CVE-2025-5940

creationtimestamp| type| source ---|---|--- 2025-06-27 07:52:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19676 2025-06-27 11:16:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsljc7w7my2a...

CVE-2025-5194 WP Map Block by aBlocks < 2.0.3 - Contributor+ Stored XSS via Marker

The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-5093

The Responsive Lightbox & Gallery WordPress plugin (versions prior to 2.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the Swipebox library failing to validate and escape title attributes before outputting them back in a page or post. This allows users with contribut...

CVE-2025-6800

creationtimestamp| type| source ---|---|--- 2025-06-27 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-459/...

CVE-2025-6731

creationtimestamp| type| source ---|---|--- 2025-06-27 01:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lskgx5d67e2i...

CVE-2025-46415

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b...

CVE-2025-45729

The D-Link DIR-823-Pro wireless router (version 1.02 ) is vulnerable to an improper privilege control flaw in its microprogrammed software. This deficiency allows unauthorized users to enable and access Telnet services , potentially granting an intruder unauthorized access to the device. While no...

CVE-2025-46415

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b...

CVE-2025-46415

CVE-2025-46415 involves a race condition in the Nix, Lix, and Guix package managers that can lead to removal of content from arbitrary folders. The connected documents specify affected versions: Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; Guix before 1.4...

CVE-2025-4437

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...