CVE-2025-4607 PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function

The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customerregistration function. This is due to the use of a weak, low-entropy OTP mechanism in the forget function. This makes it possible for...

CVE-2025-4672

CVE-2025-4672 concerns Offsprout Page Builder for WordPress, where versions 2.2.1–2.15.2 suffer from privilege escalation due to improper authorization in the permission_callback() function. The flaw enables authenticated users with Contributor-level access and above to read, create, update, or d...

CVE-2025-5368

creationtimestamp| type| source ---|---|--- 2025-05-31 04:28:24+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqgvtfaz7f42 2025-05-31 08:12:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqhcfortmr2q...

CVE-2025-5364

creationtimestamp| type| source ---|---|--- 2025-05-31 02:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqgokcrgv52m...

CVE-2025-5365

creationtimestamp| type| source ---|---|--- 2025-05-31 01:05:05+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqgkj4wljvy2 2025-05-31 02:12:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqgobcjyjl2r...

CVE-2025-48871

creationtimestamp| type| source ---|---|--- 2025-05-30 22:07:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqgam4t2os2m...

CVE-2025-48872

creationtimestamp| type| source ---|---|--- 2025-05-30 22:01:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqgabtmflb2e...

CVE-2025-1479

An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary code...

CVE-2025-5361

creationtimestamp| type| source ---|---|--- 2025-05-30 20:15:26+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqg25d7e5qg2...

CVE-2025-48882 PHPOffice Math allows XXE when processing an XML file in the MathML format

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard libxml extension and the LIBXMLDTDLOAD flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability...

CVE-2025-48944

vLLM is an inference and serving engine for large language models LLMs. In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality ...

CVE-2025-5359

creationtimestamp| type| source ---|---|--- 2025-05-30 19:07:47+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqfwicystf52 2025-05-30 22:23:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqgbjhu5kp2j...

CVE-2025-5358

creationtimestamp| type| source ---|---|--- 2025-05-30 18:17:03+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqftowd6dve2...

CVE-2025-5357

creationtimestamp| type| source ---|---|--- 2025-05-30 18:16:40+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqftn3kl37e2 2025-05-31 04:19:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114600519125395674...

CVE-2024-13916

creationtimestamp| type| source ---|---|--- 2025-05-30 16:29:09+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqfnorhcrrh2 2025-05-30 20:16:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqg2entthj2s 2025-06-10...

CVE-2024-13915

CVE-2024-13915 describes preloaded Android apps on Ulefone and Krüger&Matz devices where com.pri.factorytest exposes com.pri.factorytest.emmc.FactoryResetService, allowing any installed app to trigger a device factory reset. Affected behavior is explicitly stated; the entry notes that the APK ver...

CVE-2024-13915 Unrestricted Access to Exported Service in com.pri.factorytest

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" version name: 1.0, version code: 1 exposes a ”com.pri.factorytest.emmc.FactoryResetService“...

CVE-2025-4983

creationtimestamp| type| source ---|---|--- 2025-05-30 14:29:49+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqfgy7r2tcy2...

CVE-2025-4985 Stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting XSS vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...