CVE-2025-49455

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge WordPress-WPJobBoard click-pledge-wpjobboard allows Blind SQL Injection.This issue affects WordPress-WPJobBoard: from n/a through = 25.07010000-WP6.8.1-JB5.11.5...

CVE-2025-49454

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a through 3.10.0...

CVE-2025-49454

CVE-2025-49454 is a Local File Inclusion in the LoftOcean TinySalt WordPress theme (pre-3.10.0) caused by improper control of filenames for PHP include/require statements. The vulnerability enables PHP Local File Inclusion due to referencing an attacker-controlled filename, as reported across mul...

CVE-2025-49455

CVE-2025-49455 affects LoftOcean TinySalt (WordPress Theme) prior to 3.10.0. The issue is described as a Deserialization of Untrusted Data vulnerability that enables Object Injection . The connected sources consistently identify TinySalt and specify the vulnerable version range as before 3.10.0, ...

CVE-2025-49507

CVE-2025-49507 corresponds to a PHP Object Injection in the WordPress CozyStay theme. Multiple sources confirm CozyStay versions prior to 1.7.1 are affected by a deserialization of untrusted data vulnerability that can lead to code execution. Public advisories consistently cite CozyStay < 1.7....

PT-2025-24655 · Loftocean · Loftocean Cozystay

Name of the Vulnerable Software and Affected Versions: LoftOcean CozyStay versions prior to 1.7.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the...

PT-2025-24654 · Unknown · Loftocean Tinysalt

Name of the Vulnerable Software and Affected Versions: LoftOcean TinySalt versions prior to 3.10.0 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions prior to 3.10.0, update to version 3.10.0 or later to resolve the...

PT-2025-24653 · Unknown · Loftocean Tinysalt

Name of the Vulnerable Software and Affected Versions: LoftOcean TinySalt versions prior to 3.10.0 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

CVE-2025-49507: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through 1.7.1...

CVE-2025-49454: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a through 3.10.0...

WordPress TinySalt Theme < 3.10.0 is vulnerable to Local File Inclusion

Software TinySalt Type Theme Vulnerable versions 3.10.0 Fixed in 3.10.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49454 Patch priority High CVSS severity High 8.1 Developer LoftOcean PSID f11131feed0e Credits Bonds Required privilege Unauthenticated Published 9...

WordPress CozyStay Theme < 1.7.1 is vulnerable to PHP Object Injection

Software CozyStay Type Theme Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-49507 Patch priority High CVSS severity High 9.8 Developer LoftOcean PSID 87cadbf62283 Credits Bonds Required privilege Unauthenticated Published 9 Jun...