EUVD-2025-20001

Malicious code in bioql PyPI...

EUVD-2025-27824

Malicious code in bioql PyPI...

CVE-2025-31427

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through = 1.9...

CVE-2025-52828

Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through = 3.8...

CVE-2025-52833

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in designthemes LMS lms allows SQL Injection.This issue affects LMS: from n/a through = 9.2...

CVE-2025-52833

CVE-2025-52833 is an SQL injection in designthemes LMS (WordPress LMS theme). Affected versions are n/a through 9.1; impact is high (CVSS 3.1 base 9.3) with full confidentiality impact and partial integrity/availability concerns. Root cause: improper neutralization of special elements used in SQL...

CVE-2025-52833 WordPress LMS <= 9.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in designthemes LMS allows SQL Injection. This issue affects LMS: from n/a through 9.1...

PT-2025-27943 · Designthemes · Designthemes Lms

Name of the Vulnerable Software and Affected Versions: designthemes LMS versions n/a through 9.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: F...

PT-2025-27939 · Designthemes · Red Art

Name of the Vulnerable Software and Affected Versions: designthemes Red Art versions 3.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited due to the deserialization of untrusted data, potentially leading to...

CVE-2025-52799

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through = 9.2...

CVE-2025-52799

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through = 9.2...

PT-2025-27126 · Designthemes · Designthemes Lms

Name of the Vulnerable Software and Affected Versions: designthemes LMS versions n/a through 9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

CVE-2025-32284

Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through = 2.8...

CVE-2025-32284

Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through = 2.8...

PT-2025-22688 · Designthemes · Designthemes Crafts & Arts

Name of the Vulnerable Software and Affected Versions: designthemes Crafts & Arts versions n/a through 2.5 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For designthemes Crafts & Arts versions n/a through 2.5, update to a...

PT-2025-22695 · Designthemes · Designthemes Finance Consultant

Name of the Vulnerable Software and Affected Versions: designthemes Finance Consultant versions through 2.8 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions through 2.8, update to a version that fixes the...

CVE-2025-0845

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-0845 DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-0845 DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-0845

CVE-2025-0845 : DesignThemes Core Features (WordPress) allows Stored XSS via shortcode attributes due to insufficient input sanitization and output escaping. Affected versions are “up to and including 4.8.” Exploitation requires authenticated access at contributor+ level, enabling an attacker to ...