PT-2025-49979

Name of the Vulnerable Software and Affected Versions ProfilePress versions through 4.16.7 Description The ProfilePress plugin for WordPress is susceptible to arbitrary shortcode execution due to inadequate input sanitization of the type parameter within the form preview functionality. This allow...

PT-2025-49887

Name of the Vulnerable Software and Affected Versions Saad Iqbal Quick Contact Form versions through 8.2.5 Description A Cross-Site Request Forgery CSRF issue exists in Quick Contact Form. This allows attackers to perform actions on behalf of an authenticated user without their knowledge...

PT-2025-49722

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.40-syzkaller Description The Linux kernel contains an issue where the sk family is read only once in the sk mc loop function. This was discovered by syzbot while testing with IPV6 ADDRFORM. The issue occurs...

CVE-2025-61078

Cross-site scripting XSS vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint...

PT-2025-50400

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.23 and earlier Description A stored Cross-Site Scripting XSS issue exists in Adobe Experience Manager. A low-privileged attacker can inject malicious scripts into vulnerable form fields. Execution of...

WordPress plugin Contact Form by BestWebSoft 安全漏洞

...

PT-2025-49998

Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through = 8.9.4...

WordPress plugin Quick Contact Form 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

PT-2025-50051

Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through = 1.0.2...

GHSA-C4CC-X928-VJW9 robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation

Summary An authentication bypass vulnerability exists due to a flaw in the libxml2 canonicalization process, which is used by xmlseclibs during document transformation. This weakness allows an attacker to generate a valid signature once and reuse it indefinitely. In practice, a signature created...

CVE-2025-66301

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/pagename, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through...

CVE-2025-14196

A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public...

CVE-2025-14136

A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2RepeatergetwiredclientlistsetClientsName of the file modform.so. The manipulation of the argume...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 / CVE-2025-66478 Vulnerability Replay Environme...

Exploit for CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability !G7o6Z...

XML External Entity (XXE) Injection

Apache Tika is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of XFA content in PDFs within the tika-parser-pdf-module, where crafted XFA files can trigger XXE, allowing attackers to read sensitive files or make malicious internal or external reques...

Privacy Practices of Browser Agents

This paper presents a systematic evaluation of the privacy behaviors and attributes of eight recent, popular browser agents. Browser agents are software that automate Web browsing using large language models and ancillary tooling. However, the automated capabilities that make browser agents...

WordPress Contact Form by BestWebSoft plugin <= 4.3.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contact Form by BestWebSoft versions = 4.3.6...

CVE-2025-14196 H3C Magic B1 aspForm sub_44de0 buffer overflow

A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public...

MAL-2025-192366 Malicious code in react-hook-form-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1aa38d2e5718b378c2958a34a971314652bafc4462818307ae8e36df83f6cc7 The package react-hook-form-5 was found to contain malicious code. Source: ossf-package-analysis...