Lucene search
+L

1034 matches found

CVE
CVE
β€’added 2025/12/03 6:47 a.m.β€’306 views

CVE-2025-13486

The CVE-2025-13486 vulnerability affects the Advanced Custom Fields: Extended (ACFE) WordPress plugin, versions 0.9.0.5–0.9.1.1. It arises from the prepare_form() function, where user-supplied data is forwarded to call_user_func_array() without proper validation, enabling unauthenticated remote c...

9.8CVSS7.4AI score0.74331EPSS
SaveIn wildExploits10References2
Patchstack
Patchstack
β€’added 2025/12/03 6:19 a.m.β€’16 views

WordPress Advanced Custom Fields: Extended plugin 0.9.0.5-0.9.1.1 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Marcin Dudek dudekmar - CERT.PL in WordPress Plugin Advanced Custom Fields: Extended versions 0.9.0.5-0.9.1.1...

9.8CVSS7.9AI score0.74331EPSS
SaveExploits10References1Affected Software1
CNNVD
CNNVD
β€’added 2025/12/03 12:0 a.m.β€’31 views

WordPress plugin Advanced Custom Fields Extended 代码注ε…₯漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code injection...

9.8CVSS8.2AI score0.74331EPSS
SaveExploits10References3
Packet Storm
Packet Storm
β€’added 2025/12/03 12:0 a.m.β€’157 views

πŸ“„ phpIPAM 1.5.1 SQL Injection

phpIPAM version 1.5.1 suffers from a remote SQL injection vulnerability. Exploit Title: phpIPAM 1.5.1 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/phpipam/phpipam/ Software Link: https://github.com/phpipam/phpipam/ Version: 1.5.1 Tested on: Windo...

7.2CVSS8.2AI score0.0305EPSS
SaveExploits3
Packet Storm
Packet Storm
β€’added 2025/12/03 12:0 a.m.β€’164 views

πŸ“„ phpIPAM 1.4 SQL Injection

phpIPAM version 1.4 suffers from a remote SQL injection vulnerability in order.php. This version is also known to suffer from other vectors of attack for the same issue. Exploit Title: phpIPAM 1.4 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage:...

9.8CVSS8.1AI score0.04338EPSS
SaveExploits3
Exploit DB
Exploit DB
β€’added 2025/12/03 12:0 a.m.β€’196 views

phpIPAM 1.4 - SQL-Injection

Exploit Title: phpIPAM 1.4 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/phpipam/phpipam/ Software Link: https://github.com/phpipam/phpipam/ Version: 1.4 Tested on: Windows CVE : CVE-2019-16693 Proof Of Concept Ensure you have a valid user session...

9.8CVSS7.4AI score0.04338EPSS
SaveExploits3
Wordfence Blog
Wordfence Blog
β€’added 2025/12/02 7:47 p.m.β€’15 views

100,000 WordPress Sites Affected by Remote Code Execution Vulnerability in Advanced Custom Fields: Extended WordPress Plugin

On November 18th, 2025, we received a submission for an unauthenticated Remote Code Execution vulnerability in Advanced Custom Fields: Extended, a WordPress plugin with more than 100,000 active installations. This vulnerability can be leveraged to execute code remotely. Props to dudekmar who...

9.8CVSS9AI score0.74331EPSS
SaveExploits10
Exploit DB
Exploit DB
β€’added 2025/12/02 12:0 a.m.β€’201 views

phpIPAM 1.5.1 - SQL Injection

Exploit Title: phpIPAM 1.5.1 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/phpipam/phpipam/ Software Link: https://github.com/phpipam/phpipam/ Version: 1.5.1 Tested on: Windows CVE : CVE-2023-1211 Proof Of Concept POST...

7.2CVSS7AI score0.0305EPSS
SaveExploits3
VulnCheck KEV
VulnCheck KEV
β€’added 2025/12/02 12:0 a.m.β€’5 views

VulnCheck KEV: CVE-2025-13486

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepareform function. This is due to the function accepting user input and then passing that through calluserfuncarray. This makes it possible for...

9.8CVSS6.3AI score0.74331EPSS
SaveIn wildExploits10References3
Cvelist
Cvelist
β€’added 2025/11/18 8:27 a.m.β€’11 views

CVE-2025-12937 ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acfflmupdatetemplatewithpastedlayout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to...

6.5CVSS0.00198EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
β€’added 2025/11/18 8:27 a.m.β€’4 views

CVE-2025-12937 ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acfflmupdatetemplatewithpastedlayout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to...

6.5CVSS5AI score0.00198EPSS
SaveExploits0References2
CVE
CVE
β€’added 2025/11/18 8:27 a.m.β€’22 views

CVE-2025-12937

CVE-2025-12937 affects the WordPress plugin ACF Flexible Layouts Manager (versions

6.5CVSS5AI score0.00198EPSS
SaveExploits0References2
EUVD
EUVD
β€’added 2025/11/18 8:27 a.m.β€’6 views

EUVD-2025-197941

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acfflmupdatetemplatewithpastedlayout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to...

6.5CVSS4.9AI score0.00198EPSS
SaveExploits0References3
Patchstack
Patchstack
β€’added 2025/11/17 11:20 p.m.β€’8 views

WordPress ACF Flexible Layouts Manager plugin <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update vulnerability

Missing Authorization to Unauthenticated Custom Field Update vulnerability discovered by Ahmad Salem a7mad.cc in WordPress Plugin ACF Flexible Layouts Manager versions = 1.1.6...

6.5CVSS7AI score0.00198EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
β€’added 2025/11/10 12:40 p.m.β€’8 views

WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Denver Jackson in WordPress Plugin Custom Fields Account Registration For Woocommerce versions = 1.2...

7.2CVSS7AI score0.00343EPSS
SaveExploits0Affected Software1
RedhatCVE
RedhatCVE
β€’added 2025/11/07 12:19 a.m.β€’14 views

CVE-2025-64114

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...

6.5CVSS8AI score0.00393EPSS
SaveExploits1References1
NVD
NVD
β€’added 2025/11/06 12:15 a.m.β€’9 views

CVE-2025-64114

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...

6.5CVSS0.00393EPSS
SaveExploits1References3
CNNVD
CNNVD
β€’added 2025/11/06 12:0 a.m.β€’8 views

ClipBucket SQL注ε…₯漏洞

ClipBucket is an open source and freely downloadable PHP script from MacWarrior Open Source. It is used for sharing video sites. A SQL injection vulnerability exists in ClipBucket v5 versions 5.5.2 through 151 and earlier, which originates from a certified administrator with plugin management...

6.5CVSS8.3AI score0.00393EPSS
SaveExploits1References4
EUVD
EUVD
β€’added 2025/11/05 11:30 p.m.β€’7 views

EUVD-2025-37959

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...

6.5CVSS7.5AI score0.00393EPSS
SaveExploits1References3
Cvelist
Cvelist
β€’added 2025/11/05 11:30 p.m.β€’17 views

CVE-2025-64114 ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...

6.5CVSS0.00393EPSS
SaveExploits1References3
Rows per page
Query Builder