CVE-2025-69351

CVE-2025-69351 is a SQL injection vulnerability in Ninja Tables (Ninja Tables – Easy Data Table Builder) for WordPress. The issue affects Ninja Tables versions up to and including 5.2.4 and is exploitable via an authenticated access context, enabling improper neutralization of input in SQL comman...

CVE-2023-51513 WordPress Geo Controller plugin <= 8.5.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS.This issue affects Geo Controller: from n/a through 8.5.2...

Security Bulletin: IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410

Summary IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410. This bulletin contains information regarding the vulnerability and its fixture...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers where it could be used for header injection or in HTML in the default error page where it could be used for XSS and can ...

EUVD-2026-0452

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

PT-2025-54273

Name of the Vulnerable Software and Affected Versions Simple Archive Generator versions through 5.2 Description A Cross-Site Request Forgery CSRF issue exists in Simple Archive Generator, which also allows for Stored Cross-Site Scripting XSS. The issue allows for unauthorized actions to be...

WordPress plugin WP Attachments 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

[SECURITY] Fedora 42 Update: golang-github-jwt-5-5.2.1-4.fc42

A Go implementation of JSON Web Tokens...

ZKTeco BioTime 安全漏洞

ZKTeco BioTime is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco BioTime versions 9.0.3, 9.0.4, and 9.5.2, which stems from a vulnerability in the parameter...

CVE-2025-68617

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed...

CVE-2025-68617

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed...

CVE-2021-47732

CMSimple 5.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Filebrowser external input field. The issue allows an attacker to inject unfiltered JavaScript that executes when a user clicks the Page or Files tabs, enabling persistent script injection. Affected product/versi...

CVE-2025-66078

Improper Control of Generation of Code 'Code Injection' vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through = 5.2.3...

CVE-2025-1031

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse. This issue affects SoliClub: from 5.2.4 before 5.3.7...

CVE-2025-1031

CVE-2025-1031 describes an Authorization Bypass Through a User-Controlled Key in Utarit Informatics Services Inc. SoliClub, enabling Functionality Misuse. Multiple sources (NVD/Red Hat/CVE list/etc.) converge that SoliClub versions prior to 5.3.7 are affected (from 5.2.4 before 5.3.7). The precis...

PT-2025-52223

Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable.This issue affects SoliClub: from 5.2.4 before 5.3.7...

Security Bulletin: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data vulnerable to Deserialization of Untrusted Data due to jackson-core

Summary jackson-core is used by IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data in the repo huts-common Vulnerability Details WSID: WS-2022-0468 DESCRIPTION: The jackson-core package is vulnerable to a Denial of Service DoS attack. The methods in the classes listed below fail to...

CVE-2025-68071

CVE-2025-68071 describes an Insecure Direct Object Reference (IDOR) in the WordPress plugin “Essential Real Estate” (vendor: g5theme, affected: Essential Real Estate

CVE-2025-66127

CVE-2025-66127 concerns a Missing Authorization (broken access control) vulnerability in the WordPress plugin Essential Real Estate (g5theme Essential Real Estate) affecting versions up to 5.2.2. Affected software is the Essential Real Estate WordPress plugin; root cause is incorrectly configured...

EUVD-2025-203491

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build...