23603 matches found
CVE-2025-32102
CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI...
CVE-2025-32946 PeerTube Arbitrary Playlist Creation via ActivityPub Protocol
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request,...
CVE-2025-3608 Race condition in nsHttpTransaction could lead to memory corruption
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2...
CVE-2025-26944
creationtimestamp| type| source ---|---|--- 2025-04-15 12:38:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmu3tdocro2q 2025-04-15 12:54:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11796 2025-04-15 15:46:19+00:00| seen|...
CVE-2025-26990
creationtimestamp| type| source ---|---|--- 2025-04-15 12:38:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmu3tdhwva2r 2025-04-15 12:54:33+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11790 2025-04-15 15:46:13+00:00| seen| https://t.me/cvedetector/22940...
CVE-2025-30964
CVE-2025-30964 is a Server-Side Request Forgery (SSRF) in the WordPress Photography theme (Affecting Photography: from n/a through 7.5.2). Connected sources indicate an unauthenticated SSRF with this theme version range, and patch status is listed as Unpatched for Photography
CVE-2025-26944 WordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Crocoblock JetPopup jet-popup allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetPopup: from n/a through = 2.0.11...
CVE-2025-26955 WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in vowelweb Industrial Lite industrial-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Industrial Lite: from n/a through = 1.0.8...
CVE-2025-26743 WordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through = 1.0.10...
CVE-2025-26743 WordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through = 1.0.10...
CVE-2025-26743
CVE-2025-26743 : Reflected XSS in the WordPress plugin Advance WP Query Search Filter (affected from unspecified versions up to 1.0.10). Root cause: Improper Neutralization of Input During Web Page Generation. CVSSv3.1 base score 7.1 (HIGH) with network attack vector, no privileges, user interact...
CVE-2025-2083
The Logo Carousel Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sliderId’ parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-31147
creationtimestamp| type| source ---|---|--- 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04 2025-04-15 21:55:40+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11919 2025-04-15 22:44:14+00:00| seen|...
CVE-2025-26857
creationtimestamp| type| source ---|---|--- 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04...
CVE-2025-30206
creationtimestamp| type| source ---|---|--- 2025-04-15 06:47:26+00:00| published-proof-of-concept| https://github.com/donknap/dpanel/security/advisories/GHSA-j752-cjcj-w847 2025-04-15 22:48:41+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114344414760600683 2025-04-16...
CVE-2024-13610 Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSS
The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
CVE-2024-13207 Widget for Social Page Feeds < 6.4.2 - Admin+ Stored XSS
The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setu...
CVE-2025-32939
creationtimestamp| type| source ---|---|--- 2025-04-15 04:38:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmtaycuuse2h 2025-04-15 07:24:17+00:00| seen| https://t.me/cvedetector/22917...
CVE-2025-32997
creationtimestamp| type| source ---|---|--- 2025-04-15 02:55:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11738 2025-04-15 04:38:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmtaydu4522u 2025-04-15 07:24:09+00:00| seen|...
