CVE-2025-49331

creationtimestamp| type| source ---|---|--- 2025-06-17 15:31:06+00:00| seen| https://bsky.app/profile/potato.software/post/3lrsstpo6as23 2025-06-17 16:18:10+00:00| seen| Telegram/-G7yge5OOPwalQgUT4aKwTAwYlFDeFB7c6hZGGGT8IukU 2025-06-20 13:43:12+00:00| published-proof-of-concept|...

CVE-2025-49444

Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through = 1.0.5...

CVE-2025-49254

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through = 1.2.8...

CVE-2025-49071

Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flozen: from n/a through 1.5.1...

CVE-2025-30988

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CreativeMedia Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through = 10.0.5...

CVE-2025-39486

CVE-2025-39486 affects the WordPress plugin Rankie by ValvePress, specifically versions prior to 1.8.2. The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands. The associated CVSS 3.1 vector (N/ L / L / N / C:H / I:N / A:L; scopeChanged) yields a base ...

CVE-2025-49260

CVE-2025-49260 is a Local File Inclusion vulnerability in the WordPress theme/plugin pair “Aora” from ThemBay, affecting versions up to 1.3.9. The flaw arises from improper control of filenames for include/require statements, enabling PHP Local File Inclusion. Public sources (NVD/Red Hat/Wordfenc...

CVE-2025-49266 WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through = 3.2.14...

CVE-2025-49861 WordPress Kama Click Counter plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Timur Kamaev Kama Click Counter allows Stored XSS. This issue affects Kama Click Counter: from n/a through 4.0.3...

CVE-2025-49862 WordPress Ebook Store plugin <= 5.8008 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in motov.net Ebook Store allows Stored XSS. This issue affects Ebook Store: from n/a through 5.8008...

CVE-2025-49872 WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects myCred: from n/a through = 2.9.4.2...

CVE-2025-49447

CVE-2025-49447 affects FW Food Menu (WordPress plugin) versions up to and including 6.0.0. The issue is described as an Unrestricted Upload of File with Dangerous Type, enabling the use of malicious files via an unauthenticated arbitrary file upload path. The CVSS 3.1 vector indicates network att...

CVE-2025-49178 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service...

CVE-2025-49177

CVE-2025-49177 affects the XFIXES extension in the X.Org/X server: the XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests. Practical impact is potential local information disclosure via memory reads. The c...

CVE-2025-49177 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

CVE-2025-49176 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check...

CVE-2025-49176

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check...

CVE-2025-49177

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

CVE-2025-49177 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

CVE-2025-4754

creationtimestamp| type| source ---|---|--- 2025-06-17 14:39:56+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18591 2025-06-17 16:16:40+00:00| seen| https://bsky.app/profile/theerlef.bsky.social/post/3lrsvf54jx227 2025-06-17 18:03:24+00:00| seen|...