WordPress CraftXtore Theme <= 1.7 is vulnerable to Local File Inclusion

Software CraftXtore Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24770 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID db65eb0ec141 Credits Phat RiO - BlueRock Required privilege...

WordPress Grill and Chow Theme <= 1.6 is vulnerable to Local File Inclusion

Software Grill and Chow Type Theme Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49297 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 10cea538663d Credits Bonds Required privilege Unauthenticated...

PT-2025-24441 · Code Projects · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System versions up to 1.0 Description: A critical issue affects the processing of the file /user/confirm password.php. The manipulation of the cid argument leads to SQL injection. The attack can be initiated remotely...

PT-2025-24031 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats plugin for WordPress versions up to and including 1.0.0 Description: The issue allows authenticated attackers with Editor-level access or higher to inject additional SQL queries into existing ones, potentially extracting...

WordPress External Store for Shopify plugin <= 1.5.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by timomangcut in WordPress Plugin External Store for Shopify versions = 1.5.9...

CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

WordPress Soho Hotel Theme <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Soho Hotel Type Theme Vulnerable versions = 4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39539 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f1eee5277067 Credits Bonds Required privilege Unauthenticated...

WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability

XML External Entity XXE vulnerability discovered by mcdruid in WordPress Plugin Category Icon versions = 1.0.3...

WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Seb in WordPress Plugin WooCommerce Photo Reviews versions = 1.3.13...

PT-2025-23594 · WordPress · Woocommerce Ultimate Gift Card

Name of the Vulnerable Software and Affected Versions: Ultimate Gift Cards for WooCommerce plugin for WordPress versions prior to 3.1.5 Description: The issue is related to boolean-based SQL Injection via the default price and product id parameters. This is due to insufficient escaping of...

Dot 跨站脚本漏洞

Dot is a text-to-speech, RAG and LLM tool by alexpinel individual developers. A cross-site scripting vulnerability exists in Dot 0.9.3 and earlier versions, which stems from user input and LLM output being appended to the DOM using innerHTML, which could lead to cross-site scripting and command...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability [CVE-2024-53382]

Summary IBM Security SOAR uses an older version of prismjs that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended customers upgrade to the latest applicable fix pack 51.0.6.0 . Vulnerability Details CVEID:CVE-2024-53382...

WordPress The Fashion - Model Agency One Page Beauty Theme Theme <= 1.4.4 is vulnerable to Deserialization of untrusted data

Software The Fashion - Model Agency One Page Beauty Theme Type Theme Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Deserialization of untrusted data CVE CVE-2025-31052 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 400ca29478f9 Credi...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 139, which stems from an omission of the CSP header when previewing responses in Devtools, which could lead to a content injection...

CVE-2025-48069

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the ejson2env tool has a vulnerability related to how it writes to stdout. Specifically, the tool is intended to write an export statement for environment variables and their values...

CVE-2024-7090

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lhaddmediafromurl-fileurl’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-1791

The CodeMirror Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Code Mirror block in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

CVE-2024-29027

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulatio...

CVE-2024-10091

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...