CVE-2025-5568

CVE-2025-5568 concerns the WordPress plugin WpEvently (versions

CVE-2025-5528

CVE-2025-5528 affects the WordPress plugin “Social Sharing Plugin – Sassy Social Share” (versions ≤ 3.3.75). The issue is a reflected Cross‑Site Scripting vulnerability via the heateor_mastodon_share parameter caused by insufficient input sanitization and output escaping. It can be exploited by u...

CVE-2025-4568

Improper neutralization of input provided by an unauthorized user into changesreferenceid parameter in URL allows for boolean-based Blind SQL Injection attacks...

CVE-2025-5806

creationtimestamp| type| source ---|---|--- 2025-06-07 08:44:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lqyxibmcfb2d...

CVE-2025-5814

creationtimestamp| type| source ---|---|--- 2025-06-07 06:53:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqyrb2y6jh2e...

CVE-2025-5814

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...

CVE-2025-5814 Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...

CVE-2024-55585

In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword...

CVE-2025-49619

Skyvern through 0.1.85 is vulnerable to server-side template injection SSTI in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to...

CVE-2025-49127

creationtimestamp| type| source ---|---|--- 2025-06-06 22:53:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqxwfywuse2s 2025-06-07 20:32:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114643981379166709 2025-07-15 14:47:03+00:00| seen|...

CVE-2025-49128

creationtimestamp| type| source ---|---|--- 2025-06-06 22:48:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqxw52h2ha23...

CVE-2025-49128

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content t...

CVE-2025-49128 Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content t...

CVE-2025-49128

CVE-2025-49128 : Jackson-core contains a low-level JSON streaming parser/generator used by Jackson Data Processor. In versions 2.0.0 up to but not including 2.13.0, a flaw in JsonLocation._appendSourceDesc allows up to 500 bytes of unintended memory content to be included in exception messages wh...

CVE-2025-46339

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...

CVE-2025-49011

creationtimestamp| type| source ---|---|--- 2025-06-06 19:23:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqxkoqhiry2e...

CVE-2025-2766

70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability. The specific flaw exists within the default...

CVE-2025-49599

creationtimestamp| type| source ---|---|--- 2025-06-06 19:08:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqxjtuyoou2m...

CVE-2025-5786

creationtimestamp| type| source ---|---|--- 2025-06-06 19:03:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqxjm7f7fn2e...

CVE-2025-3485 Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability

Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementati...