CVE-2025-5107

A vulnerability was found in Fujian Kelixun 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /app/xmlcdr/xmlcdrdetails.php. The manipulation of the argument uuid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed ...

CVE-2025-39495 WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through = 2.4.9...

CVE-2025-47558

The MapSVG WordPress plugin (versions

CVE-2025-48289 WordPress Kids Planet <= 2.2.14 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet allows Object Injection. This issue affects Kids Planet: from n/a through 2.2.14...

CVE-2025-22296

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through = 1.5.0...

CVE-2025-36527

creationtimestamp| type| source ---|---|--- 2025-05-23 10:48:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17377 2025-05-23 16:00:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lptytfz4jh27...

CVE-2024-49396

The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information...

CVE-2024-48415

itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting XSS via a crafted payload to the lastname, firstname, middlename, address, contactno, email and taxid parameters in new borrowers functionality on the Borrowers page...

CVE-2024-46978

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing...

CVE-2024-8319

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tforderstatusemailresendfunction, tfvisitordetailseditfunction, tfcheckinoutdetailseditfunction,...

CVE-2024-41250

An Incorrect Access Control vulnerability was found in /smsa/viewstudents.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view STUDENT details...

CVE-2024-6392

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-lev...

CVE-2024-42560

A cross-site scripting XSS vulnerability in the component updatepagedetails.php of Blood Bank And Donation Management System commit dc9e039 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Details parameter...

CVE-2024-33247

Sourcecodester Employee Task Management System v1.0 is vulnerable to SQL Injection via admin-manage-user.php...

CVE-2024-32772

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9...

CVE-2024-39182

An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command ISP6-1779...

CVE-2024-29750

In kmexpdidinner of kmv.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-30548

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Kagan underConstruction allows Stored XSS.This issue affects underConstruction: from n/a through 1.21...

CVE-2024-29883

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the createwiki user right regardless of the settings one sets on a given wiki request. This may expose information to...

CVE-2024-22133

SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the...