CVE-2025-4577

creationtimestamp| type| source ---|---|--- 2025-06-10 11:34:12+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17868...

Security Bulletin: IBM Event Processing is vulnerable to Server-Side Request Forgery (SSRF) and credential leakage due to the axios package (CVE-2025-27152).

Summary IBM Event Processing is vulnerable to Server-Side Request Forgery SSRF and credential leakage due to the usage of axios package. The axios package is used in event processing to send or retrieve data via HTTP calls, enabling integration with external services or REST APIs during event...

Security Bulletin: IBM Event Streams is vulnerable to Server Side Request Forgery (SSRF) due to the axios component (CVE-2025-27152).

Summary IBM Event Streams is vulnerable to Server Side Request Forgery SSRF due to the axios component. In event streams, axios is used to make HTTP requests to the Event Streams REST Admin API, such as creating or listing Kafka topics. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axio...

CVE-2025-42993: Missing Authorization

Due to a missing authorization check vulnerability in SAP S/4HANA Enterprise Event Enablement, an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC...

CVE-2025-48937: Authentication Bypass by Spoofing

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those event...

matrix-rust-sdk 安全漏洞

matrix-rust-sdk is a Matrix open source implementation of the Matrix client-server library in Rust. A security vulnerability exists in matrix-rust-sdk versions 0.8.0 through 0.11.0, which stems from insufficient sender authentication and could lead to event tampering...

CVE-2025-49296

creationtimestamp| type| source ---|---|--- 2025-06-09 20:31:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17774...

WordPress WpEvently plugin <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by siavashvafshar in WordPress Plugin WpEvently versions = 4.4.2...

CVE-2025-31635

creationtimestamp| type| source ---|---|--- 2025-06-09 18:11:18+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17731...

CVE-2025-48125

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through = 3.1.51...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

CVE-2025-48125

WP Event Manager plugin for WordPress (versions 3.1.49 and earlier) is affected by CVE-2025-48125 due to improper control of filename for include/require in a PHP program, enabling Local File Inclusion (LFI) / PHP Remote File Inclusion under a PHP context. Exploitation context indicates a remote ...

CVE-2025-48125 WordPress WP Event Manager plugin <= 3.1.51 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through = 3.1.51...

GHSA-X8MP-CHX3-6X2P

creationtimestamp| type| source ---|---|--- 2025-06-09 12:54:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114653505710010379 2025-06-09 13:02:03+00:00| published-proof-of-concept| Telegram/AvRPE1FYyApk1Jln3Af0piOZ09oDjaUbhCE1oirCL83hBqc 2025-06-09 14:12:14+00:00| seen|...

CVE-2025-48062

creationtimestamp| type| source ---|---|--- 2025-06-09 12:54:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114653505710010379 2025-06-09 13:02:03+00:00| published-proof-of-concept| Telegram/AvRPE1FYyApk1Jln3Af0piOZ09oDjaUbhCE1oirCL83hBqc...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

WordPress plugin WP Event Manager 安全漏洞

WordPress WP Event Manager is an event management plugin designed specifically for WordPress that allows users to create, manage and promote various types of events including conferences, seminars, exhibitions, parties and more. A filename miscontrol vulnerability exists in WordPress WP Event...

CVE-2025-45055: Improper Neutralization of Input During Web Page Generation

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

CVE-2025-45055

Silverpeas 6.4.2 contains a stored cross-site scripting XSS vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attacker...

PT-2025-24514 · WordPress · Wp Event Manager

Name of the Vulnerable Software and Affected Versions: WP Event Manager versions 3.1.49 and earlier Description: The issue affects WP Event Manager, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...