CVE-2025-30558

CVE-2025-30558 : A CSRF flaw in the WordPress plugin ANAC XML Render (vendor: EnzoCostantini55) could enable a stored XSS. Affected versions are listed as

CVE-2025-30556 WordPress Fix Rss Feeds plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in flyaga Fix Rss Feeds allows Cross Site Request Forgery. This issue affects Fix Rss Feeds: from n/a through 3.1...

CVE-2025-30525

CVE-2025-30525 describes an SQL injection in the WP Profitshare plugin for WordPress. Public sources in Connected documents indicate the vulnerability affects WP Profitshare up to version 1.4.9 and is exploitable without authentication for some access levels (per the Wordfence vulnerability entry...

CVE-2025-0835

creationtimestamp| type| source ---|---|--- 2025-03-24 12:34:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll4rdgyi2d2m 2025-03-24 14:13:10+00:00| seen| https://t.me/cvedetector/20951...

CVE-2025-2688

creationtimestamp| type| source ---|---|--- 2025-03-24 10:02:24+00:00| seen| https://t.me/cvedetector/20947 2025-03-24 10:34:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll4kmp3jyo2l...

CVE-2025-2689

creationtimestamp| type| source ---|---|--- 2025-03-24 10:02:23+00:00| seen| https://t.me/cvedetector/20946 2025-03-24 10:34:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll4kmp6ucp24 2025-03-24 18:48:16+00:00| seen|...

CVE-2025-2680

creationtimestamp| type| source ---|---|--- 2025-03-24 04:23:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll3vwkpm7o2m 2025-03-24 04:30:46+00:00| seen| Telegram/1ji7ORYlPsQ67IthejQ--Bj4WTA7locBXszKDrQl4LKOZmY 2025-03-24 05:51:34+00:00| seen| https://t.me/cvedetector/20934...

CVE-2025-30472

A flaw was found in Corosync. In affected versions, a stack-based buffer overflow may be triggered via a large UDP packet in configurations where encryption is disabled or if an attacker knows the encryption key. This issue can lead to an application crash or other undefined behavior. Mitigation ...

CVE-2025-29294

...

CVE-2025-2659

creationtimestamp| type| source ---|---|--- 2025-03-23 22:19:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll3bl5y2at2x 2025-03-23 22:20:11+00:00| seen| https://t.me/cvedetector/20916...

CVE-2025-30204

A flaw was found in the golang-jwt implementation of JSON Web Tokens JWT. In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an...

CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

CVE-2025-2643

creationtimestamp| type| source ---|---|--- 2025-03-23 09:30:20+00:00| published-proof-of-concept| Telegram/GOxCG1BjflWilOJhCsGD03vvXqezG6y0qQYjqtBBlBLw 2025-03-23 11:28:10+00:00| seen| https://t.me/cvedetector/20895 2025-03-23 12:04:09+00:00| seen|...

CVE-2025-2628

creationtimestamp| type| source ---|---|--- 2025-03-23 01:25:30+00:00| seen| https://t.me/cvedetector/20885 2025-03-23 01:49:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkz4tpwjdg2w...

CVE-2024-10722

A stored cross-site scripting XSS vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. This can lead to data theft, account compromise, distributi...

CVE-2025-2577 Bitspecter Suite <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...

CVE-2025-1408

The CVE-2025-1408 entry affects the WordPress plugin ProfileGrid – User Profiles, Groups and Communities, up to version 5.9.4.4. The root cause is missing capability checks in pm_decline_join_group_request and pm_approve_join_group_request, allowing authenticated users with Subscriber-level acces...

CVE-2025-30204

creationtimestamp| type| source ---|---|--- 2025-03-21 22:21:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8456 2025-03-21 23:22:20+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114202990296478859 2025-03-22 00:20:13+00:00| seen|...

GHSA-MH63-6H87-95CP

creationtimestamp| type| source ---|---|--- 2025-03-21 22:21:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8456 2025-03-21 23:22:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114202990296478859...

CVE-2025-2607 phplaozhang LzCMS-LaoZhangBoKeXiTong HTTP POST Request upimage.html unrestricted upload

A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/upload/upimage.html of the component HTTP POST Request Handler. The manipulation of the argument File leads to...