WordPress Medicare Theme <= 2.1.0 is vulnerable to PHP Object Injection

Software Medicare Type Theme Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39499 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 8ac56173cd64 Credits Bonds Required privilege Unauthenticated Published...

WordPress Avantage Theme <= 2.4.6 is vulnerable to PHP Object Injection

Software Avantage Type Theme Vulnerable versions = 2.4.6 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39495 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 25b40b813078 Credits Bonds Required privilege Unauthenticated Published...

WordPress WP Image Mask plugin <= 3.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Image Mask versions = 3.1.2...

CVE-2025-4869

A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. This affects an unknown part of the file /admin/memberupdate.php. The manipulation of the argument menu leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-4861

The CVE-2025-4861 entry affects PHPGurukul Beauty Parlour Management System v1.1, targeting the /admin/admin-profile.php function. The root cause is unsafely handling the contactnumber parameter, enabling SQL injection that can be triggered remotely. Multiple connected sources corroborate a publi...

CVE-2025-3527

CVE-2025-3527 concerns the EventON Pro WordPress plugin (WordPress Virtual Event Calendar Plugin) up to version 4.9.6. The issue is a missing capability check in assets/lib/settings/settings.js that allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scri...

WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin WordPress Events Calendar Registration & Tickets versions = 2.6.0...

Alibaba Cloud Linux 3 : 0036: libpq (ALINUX3-SA-2025:0036)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0036 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-1094: Improper neutralization of quoting...

CVE-2024-35281

An improper isolation or compartmentalization vulnerability CWE-653 in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variabl...

CVE-2024-23815

A vulnerability has been identified in Desigo CC All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone, Desigo CC All versions if access from Installed Clients to Desigo CC server is only allowed within highly protected zones...

WordPress BNS Twitter Follow Button plugin <= 0.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin BNS Twitter Follow Button versions = 0.3.8...

WordPress 1 Click WordPress Migration Plugin plugin <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Kate Kligman Sunsword in WordPress Plugin 1 Click WordPress Migration versions = 2.2...

WordPress Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.25 - Cross Site Scripting (XSS) Vulnerability

WordPress Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery plugin = 2.7.7.25 - Cross Site Scripting XSS Vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin Photo Gallery versions = 2.7.7.25...

WordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Woobox versions = 1.6...

WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Open Close WooCommerce Store versions = 4.9.9...

WordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Simple Blog Stats versions = 20250416...

PT-2025-19926 · Unknown · Sourcecodester Online Student Clearance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Student Clearance System version 1.0 Description: A critical issue was found in the /Admin/login.php file, affecting unknown code. The manipulation of the username and password arguments leads to SQL injection. The attac...

Langroid Allows XXE Injection via XMLToolMessage

Summary A LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Details XMLToolMessage uses lxml without safeguards:...

CVE-2025-4263 PHPGurukul Online DJ Booking Management System booking-search.php sql injection

A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotel...

CVE-2025-32974

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page...