6722 matches found
CVE-2025-2203 WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-9765
The CVE-2024-9765 entry concerns the WordPress plugin EKC Tournament Manager (versions before 2.2.2). Affected component: EKC Tournament Manager plugin. Description from multiple sources indicates an admin-level vulnerability where a logged-in administrator can download system files outside the W...
CVE-2024-13729 Podlove Podcast Publisher < 4.1.24 - Admin+ Stored XSS
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Chromium: CVE-2025-4609 Incorrect handle provided in unspecified circumstances in Mojo
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2025-43853
CVE-2025-43853 concerns the WebAssembly Micro Runtime (WAMR) iwasm binary, including builds with WASI support. A symlink-following vulnerability affects WAMR up to and including version 2.2.0 (and WAMR builds on Windows using libc-uvwasi), where creating a symlink outside the preopened sandbox an...
CVE-2025-4708
CVE-2025-4708 affects Campcodes Sales and Inventory System 1.0. The issue is an SQL injection in an unknown function of the file /pages/sales_add.php, triggered by manipulating the discount parameter. It is exploitable remotely, and the exploit has been disclosed publicly. Several connected sourc...
CVE-2025-44180
creationtimestamp| type| source ---|---|--- 2025-05-15 15:03:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp7rvgzb442n 2025-05-15 16:35:22+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16528...
CVE-2025-30199
creationtimestamp| type| source ---|---|--- 2025-05-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19...
CVE-2025-3917
creationtimestamp| type| source ---|---|--- 2025-05-15 04:42:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp6p7tgsv22e 2025-05-15 14:35:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16514...
CVE-2025-4579
creationtimestamp| type| source ---|---|--- 2025-05-15 02:32:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16437 2025-05-15 02:57:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp6jdx32gf2p...
CVE-2024-56427
creationtimestamp| type| source ---|---|--- 2025-05-14 22:57:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp63whbu2k2w...
CVE-2025-24274
An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious app may be able to gain root privileges...
CVE-2025-4637
creationtimestamp| type| source ---|---|--- 2025-05-14 18:57:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp5oj27p6w2h...
CVE-2025-47702
Drupal oEmbed Providers module is affected by an XSS vulnerability from improper input neutralization during web page generation. Affected versions are 0.0.0 through 2.2.1; update to 2.2.2 or later to resolve. Several sources describe this as unauthenticated XSS impacting Drupal oEmbed Providers.
CVE-2025-46740
An authenticated user without user administrative permissions could change the administrator Account Name...
CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...
CVE-2025-47436
Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory...
CVE-2025-0130
creationtimestamp| type| source ---|---|--- 2025-05-14 14:00:00+00:00| seen| https://security.paloaltonetworks.com/CVE-2025-0130 2025-05-14 16:52:23+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114507221776253105 2025-05-14 18:57:18+00:00| seen|...
CVE-2025-4554
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/bwdates-passreports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiat...