CVE-2025-5163

A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2025-37992

In the Linux kernel, the following vulnerability has been resolved: netsched: Flush gsoskb list too during -change Previously, when reducing a qdisc's limit via the -change operation, only the main skb queue was trimmed, potentially leaving packets in the gsoskb list. This could result in NULL...

CVE-2025-5152

creationtimestamp| type| source ---|---|--- 2025-05-25 17:46:58+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17511 2025-05-25 21:41:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpzmt6afbr2r...

CVE-2025-5132

CVE-2025-5132 affects Tmall Demo up to 20250505, exposing a cross-site request forgery in the file tmall/admin/account/logout. The CSRF arises from misuse of this logout endpoint and can be triggered remotely; exploitation has been disclosed publicly. Affected/general details are not version-scop...

CVE-2025-3869

The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious w...

CVE-2025-5055 Smart Forms <= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-48702

creationtimestamp| type| source ---|---|--- 2025-05-23 17:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpu6xpdrrz2w...

CVE-2025-5114

creationtimestamp| type| source ---|---|--- 2025-05-23 17:21:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpu5eeehbp2m...

CVE-2025-3894

creationtimestamp| type| source ---|---|--- 2025-05-23 16:05:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lptz4eg6lg2o...

CVE-2025-47568

Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through = 6.91...

CVE-2025-31912 WordPress Enzio - Responsive Business WordPress Theme theme < 1.2.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Enzio - Responsive Business WordPress Theme enzio allows PHP Local File Inclusion.This issue affects Enzio - Responsive Business WordPress Theme: from n/a through 1.2.6...

CVE-2025-31912 WordPress Enzio - Responsive Business WordPress Theme <= 1.1.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Enzio - Responsive Business WordPress Theme allows PHP Local File Inclusion. This issue affects Enzio - Responsive Business WordPress Theme: from n/a through 1.1.8...

CVE-2025-31916

CVE-2025-31916 : JP Students Result Management System Premium WordPress plugin, versions 1.1.7 and earlier, is vulnerable to Unrestricted Upload of File with Dangerous Type. This allows an attacker to upload a Web Shell to the web server, enabling potential full compromise of the server. Root cau...

CVE-2025-39495

Summary for CVE-2025-39495 : BoldThemes Avantage (WordPress Theme)

CVE-2025-46456 WordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Sliders allows Reflected XSS. This issue affects Theme Blvd Sliders: from n/a through 1.2.5...

CVE-2025-47438

CVE-2025-47438 - WP Job Portal plugin for WordPress suffers from an unauthenticated local file inclusion due to improper control of the filename for include/require in PHP. This allows an attacker to include local files on the server when exploiting WP Job Portal versions at or below 2.3.1. Multi...

CVE-2025-47535 WordPress Opal Woo Custom Product Variation plugin <= 1.2.0 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through = 1.2.0...

CVE-2025-47660 WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through = 2.16...

CVE-2025-47660

CVE-2025-47660 is a deserialization of untrusted data vulnerability (PHP Object Injection) in the WordPress plugin WC Affiliate by Codexpert. Affected versions are listed as from n/a through 2.9.1, with related sources noting a broader reference set including WC Affiliate

CVE-2025-48273 WordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.This issue affects WP Job Portal: from n/a through = 2.3.2...