WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Lazy Load Optimizer versions = 1.4.7...

CVE-2025-6550

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideroptions’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Fortinet FortiADC 操作系统命令注入漏洞

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. An operating system command injection vulnerability exists in Fortinet FortiADC, which stems from improper neutralization of special elements and could lead to OS command injection. The following versions are affected:...

CVE-2025-39504 WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL Injection.This issue affects Goodlayers Hotel: from n/a through = 3.1.4...

CVE-2024-20992

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Content integration. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter...

CVE-2024-54514

The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to break out of its sandbox...

CVE-2023-21942

Vulnerability in Oracle Essbase component: Security and Provisioning. The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a...

CVE-2023-21943

Vulnerability in Oracle Essbase component: Security and Provisioning. The supported version that is affected is 21.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction from a...

CVE-2023-27446

Cross-Site Request Forgery CSRF vulnerability in Fluenx DeepL API translation plugin = 2.1.4 versions...

CVE-2022-29653

OFCMS v1.1.4 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/comn/service/update.json...

CVE-2020-14555

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

FlatPress 安全漏洞

FlatPress is a lightweight, easy-to-setup flat file blogging engine from the FlatPress open source. A security vulnerability exists in FlatPress versions prior to 1.4 that stems from improper input neutralization and could lead to a stored cross-site scripting attack...

AbanteCart 跨站脚本漏洞

AbanteCart is an open source PHP-based e-commerce platform from AbanteCart. A cross-site scripting vulnerability exists in AbanteCart v1.4.0, which stems from the presence of reflective cross-site scripting in the /eyes parameter, which could lead to the execution of malicious code...

CVE-2025-32389

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure ?param0=a1=b2=c utiliz...

CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

PT-2025-15729 · Unknown · Purab Seo Meta Tags

Name of the Vulnerable Software and Affected Versions: Purab Seo Meta Tags versions 1.4 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Purab Seo Meta Tags, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Purab Seo Meta Tags version...

CVE-2025-31767

CVE-2025-31767 - Stored XSS in Post Custom Templates Lite (WordPress). Affected: Post Custom Templates Lite, versions up to 1.14. Root cause and exposure details are not explicitly stated beyond stored XSS. Public references in the connected docs indicate the vulnerability remains unpatched in th...

SMF（Simple Machines Forum） 跨站脚本漏洞

SMF Simple Machines Forum is a free, open source community forum project by Simple Machines Open Source. A cross-site scripting vulnerability exists in SMF Simple Machines Forum version 2.1.4, which stems from improper manipulation of the Notice parameter in the ManageAttachments.php file, and...

PT-2025-11254

Name of the Vulnerable Software and Affected Versions: Civi - Job Board & Freelance Marketplace WordPress Theme plugin versions up to, and including, 2.1.4 Description: The issue is due to a lack of user validation before changing a password, making it possible for unauthenticated attackers to...

CVE-2025-0114 PAN-OS: Denial of Service (DoS) in GlobalProtect

A Denial of Service DoS vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect...