23602 matches found
CVE-2025-46618
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab...
CVE-2025-28354
An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST request...
CVE-2025-3912
CVE-2025-3912 affects the WordPress plugin WS Form LITE – Drag & Drop Contact Form Builder for WordPress. The issue is a missing capability check in the get_config function, allowing unauthenticated attackers to read the plugin’s settings and API keys. Impact is unauthenticated sensitive informat...
CVE-2025-1565
CVE-2025-1565 concerns the Mayosis Core WordPress plugin (versions ≤ 5.4.1). An Arbitrary File Read via library/wave-audio/peaks/remote_dl.php allows unauthenticated attackers to read server files containing sensitive data. Public advisories from Red Hat, NVD, CVE listings, and Patchstack corrobo...
CVE-2025-3870 1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to...
CVE-2025-46482
creationtimestamp| type| source ---|---|--- 2025-04-25 08:07:32+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13392 2025-04-25 09:20:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnmvfycwv32v 2025-04-25 10:44:57+00:00| seen|...
CVE-2025-3866
The Add Google +1 Plus one social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the google-plus-one-share-button page. This makes it possible for unauthenticated...
CVE-2025-3743 Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation
The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'addofferincart' function...
CVE-2025-0671
CVE-2025-0671 affects Icegram Express WordPress plugin prior to 5.7.50. The vulnerability is a Stored XSS in template settings that could be triggered by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (such as in multisite). Impact is variable; attacker could inject ...
CVE-2025-3923
creationtimestamp| type| source ---|---|--- 2025-04-25 05:42:34+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnmiyxhzqsr2 2025-04-25 06:10:52+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13381 2025-04-25 09:09:09+00:00| seen|...
CVE-2025-3861
CVE-2025-3861 affects the WordPress plugin Prevent Direct Access – Protect WordPress Files (versions 2.8.6–2.8.8.2). A misconfigured capability check in pda_lite_custom_permission_check allows authenticated users with Contributor+ privileges to access and modify the protection status of media. At...
CVE-2025-23246
creationtimestamp| type| source ---|---|--- 2025-04-25 03:23:17+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lnmbhiqp2k22 2025-05-01 15:15:31+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14309 2025-05-01 19:01:23+00:00| seen| https://t.me/cvedetector/24236...
CVE-2025-46545
creationtimestamp| type| source ---|---|--- 2025-04-25 03:06:47+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13370 2025-04-25 04:04:39+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnmdotkurin2 2025-04-25...
CVE-2025-46545
In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires...
CVE-2025-46613
OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavailable...
CVE-2025-46613
OpenPLC 3 through 64f9c11 is affected by a memory corruption vulnerability in server.cpp caused by a thread accessing the handleConnections arguments after the parent stack frame becomes unavailable, i.e., a race condition. This is documented across multiple sources (NVD/Red Hat/CIRCL/CNNVD, PT-S...
CVE-2025-32986
NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...
CVE-2024-30127
Missing "no cache" headers in HCL Leap permits sensitive data to be cached...