PT-2025-33715 · Sma Solar Technology · Sunny Portal

Name of the Vulnerable Software and Affected Versions: Sunny Portal affected versions not specified Description: A low-privileged remote attacker can obtain the username of another registered user by entering that user's email address. Recommendations: At the moment, there is no information about...

PT-2025-33860 · Unknown · Easy Hosting Control Panel

Name of the Vulnerable Software and Affected Versions: Easy Hosting Control Panel EHCP version 20.04.1.b Description: The Easy Hosting Control Panel EHCP contains a SQL injection issue via the id parameter in the List All Email Addresses function. Recommendations: At the moment, there is no...

CVE-2025-8898

CVE-2025-8898 concerns the WordPress plugin “Taxi Booking Manager for Woocommerce | E-cab”. The vulnerability allows privilege escalation via account takeover in all versions up to and including 1.3.0 (Wordfence notes 1.3.0; PT Security references 1.3.1+ as the fix). The root cause is insufficien...

PT-2025-33540 · WordPress · Taxi Booking Manager For Woocommerce | E-Cab Plugin +1

Name of the Vulnerable Software and Affected Versions: E-cab plugin for WordPress versions prior to 1.3.1 Description: The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of a user...

CVE-2025-9013

A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.0. This vulnerability affects unknown code of the file /shopping/password-recovery.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclos...

CVE-2025-9013

Summary of vulnerability (CVE-2025-9013) : PHPGurukul Online Shopping Portal Project 2.0 has a SQL injection flaw in the file /shopping/password-recovery.php triggered by manipulating the emailid parameter. This vulnerability can be exploited remotely and has publicly disclosed exploits. Multiple...

CVE-2023-41523

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php...

Linux Distros Unpatched Vulnerability : CVE-2025-26695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email...

Student Attendance Management System 安全漏洞

Student Attendance Management System is a student attendance management system by rickxy individual developer. A security vulnerability exists in Student Attendance Management System v1. The vulnerability stems from a SQL injection due to incorrect manipulation of the emailAddress parameter in th...

CVE-2024-34327: Improper Neutralization of Special Elements used in an SQL Command

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2025-1313

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it...

CVE-2025-1313

The CVE-2025-1313 entry concerns Nokri – Job Board WordPress Theme. Connected sources confirm a privilege escalation via account takeover vulnerability affecting versions

CVE-2025-1313 Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it...

CVE-2025-1313: Authentication Bypass Using an Alternate Path or Channel

The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it...

CVE-2025-53374

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...

CVE-2025-28976

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through = 3.3.6...

CVE-2025-28976

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through = 3.3.6...

CVE-2025-28976 WordPress Email Address Security by WebEmailProtector plugin <= 3.3.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through = 3.3.6...

CVE-2025-28976

CVE-2025-28976 corresponds to a Stored XSS in the WordPress plugin Email Address Security by WebEmailProtector (versions &lt;= 3.3.6). The issue stems from improper input neutralization during web page generation, enabling cross-site scripting when user-supplied input is rendered. Affected softwa...

CVE-2025-28976 WordPress Email Address Security by WebEmailProtector <= 3.3.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dsrodzin Email Address Security by WebEmailProtector allows Stored XSS. This issue affects Email Address Security by WebEmailProtector: from n/a through 3.3.6...