EUVD-2022-43903

Malicious code in bioql PyPI...

EUVD-2022-46967

Malicious code in bioql PyPI...

EUVD-2022-39715

Malicious code in bioql PyPI...

EUVD-2022-32832

Malicious code in bioql PyPI...

EUVD-2022-34255

Malicious code in bioql PyPI...

WordPress Bonus for Woo plugin <= 7.6.6 - Other Vulnerability Type vulnerability

Other Vulnerability Type vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Bonus for Woo versions = 7.6.6...

WordPress HT Mega plugin <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions vulnerability

Authenticated Author+ Path Traversal to Limited Arbitrary CSS File Actions vulnerability discovered by wesley wcraft in WordPress Plugin HT Mega versions = 2.9.1...

CVE-2025-34074

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...

CVE-2025-34074 Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Bao Patchstack Alliance in WordPress Plugin Custom Login And Signup Widget versions = 1.0...

WordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Reformer for Elementor versions = 1.0.5...

WordPress Diza Theme <= 1.3.8 is vulnerable to Local File Inclusion

Software Diza Type Theme Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-49261 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 245a89f54fc7 Credits Phat RiO - BlueRock Required privilege...

WordPress Besa Theme <= 2.3.8 is vulnerable to Local File Inclusion

Software Besa Type Theme Vulnerable versions = 2.3.8 Fixed in 2.3.10 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-49252 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ea01ea6c86b2 Credits Phat RiO - BlueRock Required privilege...

WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Newspack Newsletters versions = 3.13.0...

WordPress BRW plugin <= 1.8.6 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin BRW versions = 1.8.6...

SAP GuiXT Scripting Issues

Multiple vulnerabilities have been discovered in SAP GuiXT scripting, which could allow an attacker to perform remote code execution, steal NTLM hashes, conduct client-side request forgery attacks, and launch denial of service DoS attacks. These vulnerabilities arise from insecure design principl...

CVE-2022-28387

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affec...

CVE-2022-40895

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password...

CVE-2022-44212

In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel...

CVE-2022-37062

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and...