CVE-2025-9631

The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatsetajax function. This makes it possible for unauthenticated attackers to trigger automatic...

CVE-2025-8417 Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection

The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...

WordPress Mixtape plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang in WordPress Plugin Mixtape versions = 1.1...

WordPress BeyondCart Connector plugin <= 3.0.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin BeyondCart Connector versions = 3.0.1...

PT-2025-37144

The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish save option function. This makes it possible for unauthenticated attackers to modify plugin settings...

oasys 安全漏洞

oasys is an OA office automation system by the individual developer misstt123. A security vulnerability exists in oasys v1.1, which stems from the vulnerability of ProcedureController to directory traversal attacks...

Linux Distros Unpatched Vulnerability : CVE-2015-3845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of...

WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bao - BlueRock in WordPress Plugin Export WP Page to Static HTML/CSS versions = 4.1.0...

CVE-2025-40795

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, User Management Component UMC All versions V2.15.1.3. Affected products contain a stack-based buffer overflow vulnerability in the...

CVE-2025-40798

CVE-2025-40798 affects Siemens SIMATIC PCS neo versions 4.1, 5.0, 6.0 (all versions) and the embedded User Management Component (UMC) versions prior to 2.15.1.3. The vulnerability is an out-of-bounds read in the UMC that could allow an unauthenticated remote attacker to cause a denial of service....

CVE-2025-40797

CVE-2025-40797 affects Siemens SIMATIC PCS neo and its User Management Component (UMC). The UMC contains an out-of-bounds read vulnerability that can be triggered by an unauthenticated remote attacker, causing a denial of service. Affected products include PCS neo v4.1, v5.0, and v6.0 (all versio...

CVE-2025-40795

The CVE-2025-40795 issue affects Siemens SIMATIC PCS neo versions 4.1, 5.0 and 6.0, and the integrated User Management Component (UMC)

CVE-2025-40795

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, User Management Component UMC All versions V2.15.1.3. Affected products contain a stack-based buffer overflow vulnerability in the...

Siemens SIMATIC PCS neo和Siemens User Management Component 缓冲区错误漏洞

Siemens SIMATIC PCS neo and Siemens User Management Component are both products of Siemens, Germany.Siemens SIMATIC PCS neo is a distributed control system.Siemens User Management The Siemens SIMATIC PCS neo is a distributed control system, and the Siemens User Management Component is a component...

PT-2025-36684

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 All versions SIMATIC PCS neo versions 5.0 All versions User Management Component UMC versions prior to 2.15.1.3 Description: The software contains an out-of-bounds read issue in the integrated User Management...

PT-2025-36683

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 All versions SIMATIC PCS neo versions 5.0 All versions User Management Component UMC versions prior to 2.15.1.3 Description: The software contains an out-of-bounds read issue in the integrated User Management...

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Summary The Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a...

CVE-2025-58866

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve Embedded Sensitive Data.This issue affects Site Info: from n/a through = 1.1...

CVE-2025-58847

Cross-Site Request Forgery CSRF vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a through = 2.1...

WordPress StreamWeasels Kick Integration plugin <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via vodsChannel Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin SW Kick Integration versions = 1.1.5...