CVE-2025-48125

creationtimestamp| type| source ---|---|--- 2025-06-09 18:48:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr7252qtzx2m...

CVE-2025-49652 Improper access control allows arbitrary account creation

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled...

CVE-2025-49141

creationtimestamp| type| source ---|---|--- 2025-06-09 16:20:55+00:00| published-proof-of-concept| https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw 2025-06-09 21:31:56+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17782 2025-06-09...

CVE-2025-49282

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Magze magze allows PHP Local File Inclusion.This issue affects Magze: from n/a through = 1.0.9...

CVE-2025-48130

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through = 2.0.7.4...

CVE-2025-47651

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through = 2.15.06...

CVE-2025-32291

Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through 11.1.0...

CVE-2025-32308

Missing Authorization vulnerability in looksawesome Team Builder a-team-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Builder: from n/a through = 1.5.7...

CVE-2025-31917

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Universal Video Player universalvideoplayer allows Reflected XSS.This issue affects Universal Video Player: from n/a through = 3.8.3...

CVE-2023-26005

The CVE-2023-26005 entry covers BZOTheme Fitrush (WordPress theme) with an Improper Control of Filename for Include/Require Statement (PHP Remote File Inclusion) that leads to local file inclusion. Affected versions are Fitrush up to 1.3.4. The root cause, as stated, is improper filename handling...

CVE-2025-31019 WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through = 2.0.4...

CVE-2025-31022 WordPress PayU India plugin < 3.8.8 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through 3.8.8...

CVE-2025-31050 WordPress Apptha Slider Gallery plugin <= 2.5 - Arbitrary File Read vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allows Path Traversal.This issue affects Apptha Slider Gallery: from n/a through = 2.5...

CVE-2025-31396 WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5...

CVE-2025-31426 WordPress Sticky Radio Player plugin <= 3.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Sticky Radio Player allows Reflected XSS. This issue affects Sticky Radio Player: from n/a through 3.4...

CVE-2025-47511 WordPress Welcart e-Commerce <= 2.11.13 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in nanbu Welcart e-Commerce allows Path Traversal. This issue affects Welcart e-Commerce: from n/a through 2.11.13...

CVE-2025-48126 WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through = 5.2.9...

CVE-2025-48129 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP...

CVE-2025-48140 WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through = 1.1.4...

CVE-2025-48267 WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2...