CVE-2025-39553

CVE-2025-39553 (Church Admin plugin) details : A Missing Authorization vulnerability affects WordPress Church Admin instances using versions from unknown up to 5.0.9. The CVE entry indicates potential unauthorized access leading to data exposure (the vulnerability is categorized as Missing Author...

CVE-2025-40795

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, User Management Component UMC All versions V2.15.1.3. Affected products contain a stack-based buffer overflow vulnerability in the...

CVE-2025-40798

CVE-2025-40798 affects Siemens SIMATIC PCS neo versions 4.1, 5.0, 6.0 (all versions) and the embedded User Management Component (UMC) versions prior to 2.15.1.3. The vulnerability is an out-of-bounds read in the UMC that could allow an unauthenticated remote attacker to cause a denial of service....

CVE-2025-40795

The CVE-2025-40795 issue affects Siemens SIMATIC PCS neo versions 4.1, 5.0 and 6.0, and the integrated User Management Component (UMC)

CVE-2025-42914

Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiali...

CVE-2025-10114 PHPGurukul Small CRM profile.php sql injection

A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used...

PT-2025-36550

Name of the Vulnerable Software and Affected Versions: SAP HCM Approve Timesheets Fiori 2.0 application affected versions not specified Description: The SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, leading to privilege...

Siemens SIMATIC PCS neo和Siemens User Management Component 缓冲区错误漏洞

Siemens SIMATIC PCS neo and Siemens User Management Component are both products of Siemens, Germany.Siemens SIMATIC PCS neo is a distributed control system.Siemens User Management The Siemens SIMATIC PCS neo is a distributed control system, and the Siemens User Management Component is a component...

PT-2025-36683

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 All versions SIMATIC PCS neo versions 5.0 All versions User Management Component UMC versions prior to 2.15.1.3 Description: The software contains an out-of-bounds read issue in the integrated User Management...

PT-2025-36684

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 All versions SIMATIC PCS neo versions 5.0 All versions User Management Component UMC versions prior to 2.15.1.3 Description: The software contains an out-of-bounds read issue in the integrated User Management...

PT-2025-36530

Name of the Vulnerable Software and Affected Versions: itsourcecode Student Information Management System version 1.0 Description: A weakness exists in itsourcecode Student Information Management System 1.0. The issue involves SQL injection caused by manipulation of the ID argument within an...

Security update for 7zip (moderate)

openSUSE Security Update: Security update for 7zip Announcement ID: openSUSE-SU-2025:0339-1 Rating: moderate References: 1246706 1246707 1249130 Cross-References: CVE-2025-53816 CVE-2025-53817 CVSS scores: CVE-2025-53816 SUSE: 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N...

CVE-2025-10059

Summary: A vulnerability in MongoDB where an improper setting of the lsid field on a sharded query can crash MongoDB routers. Root cause: mis-handling of a generic argument (lsid) when not applicable. Affected versions: MongoDB Server 6.0.x before 6.0.24; 7.0.x before 7.0.18; 8.0.x before 8.0.6. ...

CVE-2025-58628

CVE-2025-58628 refers to a SQL injection vulnerability in the WordPress theme Miraculous (versions before 2.0.9). The issue is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection. Public writeups and vulnerability feeds confirm affected software as ...

CVE-2025-58844 WordPress Database to Excel Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: from n/a through = 1.0...

CVE-2025-58815

CVE-2025-58815 is a WordPress plugin vulnerability in the Aitasi Coming Soon plugin (versions

CVE-2025-58815 WordPress Aitasi Coming Soon Plugin <= 2.0.2 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in Rubel Miah Aitasi Coming Soon aitasi-coming-soon allows Object Injection.This issue affects Aitasi Coming Soon: from n/a through = 2.0.2...

WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Authors List versions = 2.0.6.2...

WordPress plugin New Simple Gallery SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2025-41046

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/960grid...