CVE-2025-68111

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the eGive.php file within the "ReImport" functionality. An authenticated user with finance privileges can execute arbitrary SQL queries by manipulating the MissingEgiveFamID...

CVE-2025-13750

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /webp-converter/v1/regenerate-attachment REST endpoint in all versions up to, and including, 6.3.2. This makes it possib...

CVE-2025-14061 Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy : WP Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the gdprdeletepolicydata function in all versions up to, and...

CVE-2025-13880

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets Google Reviews, YouTube Feed, Photo Feeds, and More plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings...

The vulnerability in the web interface of the Juniper Networks Junos Space Security Director allows a attacker to gain unauthorized access to and modify protected information.

The vulnerability of the Juniper Networks Junos Space Security Director web interface interface is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to and modify the protected information...

PT-2025-51929

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the eGive.php file within the "ReImport" functionality. An authenticated user with finance privileges can execu...

CVE-2025-14061: Missing Authorization

The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy : WP Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the gdprdeletepolicydata function in all versions up to, and...

The vulnerability of the PIA Core Technology component of the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain read, modify, and delete access to data.

The vulnerability of the PIA Core Technology component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to a breach of the buffer’s initial boundary. Exploiting this vulnerability could allow an attacker operating remotely to gain read, modify, and delete acce...

HCL DevOps Deploy 安全漏洞

HCL DevOps Deploy is an application from HCL India. It can be mapped to your organizational structure using flexible team-based and role-based security models. HCL DevOps Deploy has a security vulnerability that stems from the explicit transmission of sensitive information, which could lead to th...

PT-2025-51228

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add images to gallery callback function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers,...

The vulnerability of the Application Logging Interfaces component in the Oracle Applications Manager allows a malicious actor to gain access to read, modify, and delete data.

The vulnerability of the Application Logging Interfaces component in the Oracle Applications Manager management tool is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete privileges on data...

The vulnerability of the Rich Text Editor component in the Oracle PeopleSoft Enterprise PeopleTools business application package allows a hacker to gain access to read, modify, and delete data.

The vulnerability of the Rich Text Editor component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to the violation of the buffer’s initial limit. Exploiting this vulnerability can allow an attacker to gain read, modify, and delete access to data...

The vulnerability of the Workflow Notification Mailer component of the Oracle Workflow system, a process management system for automating business activities within the Oracle E-Business Suite. This component allows an intruder to gain access to read, modify, and delete data.

The vulnerability of the Workflow Notification Mailer component of the Oracle Workflow process management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to read, modify, and delete data...

The vulnerability of the Upload Attachments component of the Oracle Applications Framework software platform, which is part of the Oracle E-Business Suite, allows a malicious individual to access and modify or delete data.

The vulnerability of the Upload Attachments component in the Oracle Applications Framework software of the Oracle E-Business Suite system for enterprise automation activities is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to...

The vulnerability of the Java VM component of the Oracle Database Server management system allows a hacker to gain access to and modify or delete data.

The vulnerability of the Java VM component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker operating remotely to gain access to modify and delete data...

The vulnerability of the personalization feature of the Oracle Applications Framework, a system for automating business operations in Oracle E-Business Suite, allows a perpetrator to gain access to modify and delete data.

The vulnerability of the Oracle Applications Framework, a software platform used in Oracle E-Business Suite, relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify and delete data...

The vulnerability of the Object and Environment Tech components of the JD Edwards EnterpriseOne Tools system management resource management solution allows a malicious actor to gain access to read, modify, and delete data.

The vulnerability of the Object and Environment Tech components of the JD Edwards EnterpriseOne Tools system management resource solution is related to authentication errors. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete access to data...

CVE-2025-14395

The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions e.g., popsubmit, popthemesubmit in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2025-14446

The Popup Builder Easy Notify Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotifycpreset function in all versions up to, and including, 1.1.37. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-14397

The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postemipsumgenerateusers function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with...