CVE-2025-4795 gongfuxiang schoolcms index.php SaveInfo sql injection

A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.php?m=Admin&c=article&a=SaveInfo. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-30667

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access...

CVE-2025-46786

Improper neutralization of special elements in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access...

CVE-2025-4637

Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file. .This issue affects dlib: before 19.24.7...

CVE-2025-4476

creationtimestamp| type| source ---|---|--- 2025-05-16 18:03:16+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114518825078773948 2025-05-16 19:07:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpcpzcyo2d2p 2025-10-09 17:51:29+00:00| seen|...

CVE-2025-4476 Libsoup: null pointer dereference in libsoup may lead to denial of service

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

CVE-2025-4789 FreeFloat FTP Server LCD Command buffer overflow

A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed ...

CVE-2025-48134

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through = 2.2.12...

CVE-2025-39537

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through = 1.2.3...

CVE-2025-39492

Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision...

CVE-2025-31637

CVE-2025-31637 is a SQL Injection vulnerability reported for the WordPress SHOUT plugin (LambertGroup SHOUT), affecting SHOUT versions n/a through 3.5.3. The vulnerability arises from improper neutralization of input in SQL commands, enabling SQL Injection. Public sources rate the impact as high ...

CVE-2025-31915 WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through = 1.0.3...

CVE-2025-46464 WordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through = 5.0...

CVE-2025-48134

CVE-2025-48134 : Deserialization of untrusted data in the WordPress plugin WP Tabs (ShapedPlugin LLC) allows PHP Object Injection . Affected: WP Tabs &lt;= 2.2.11 (WordPress plugin offering responsive tabs and custom product tabs). The vulnerability origin is a deserialization flaw leading to obj...

CVE-2025-48121 WordPress WP Notes Widget <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Steve Puddick WP Notes Widget allows DOM-Based XSS. This issue affects WP Notes Widget: from n/a through 1.0.6...

CVE-2025-48117 WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability

Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through = 1.7.8...

CVE-2025-4785

A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user-profile.php. The manipulation of the argument fullname/contactnumber leads to sql injection. The attack may be launched...

CVE-2025-47791

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests...

CVE-2025-47793

creationtimestamp| type| source ---|---|--- 2025-05-16 15:15:33+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114518165552832603 2025-05-16 15:16:04+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114518167613475040...

CVE-2024-52601

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...