PT-2026-1302

Name of the Vulnerable Software and Affected Versions Dokan Pro versions through 3.14.5 Description A flaw exists in Dokan Pro that allows for Stored Cross-Site Scripting XSS. This issue is due to improper neutralization of input during web page generation. An attacker could potentially inject...

WordPress plugin Ads Pro Plugin has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Simple Link Directory Pro has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin CountDown Pro WP Plugin has a SQL injection vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

CVE-2025-46464: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through = 5.0...

PT-2025-21688 · Unknown · Salon Booking Pro

Name of the Vulnerable Software and Affected Versions: Salon Booking Pro versions 10.10.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 10.10.2 an...

CVE-2025-32301: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown Pro WP Plugin circularcountdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through = 2.7...

WordPress plugin Salon Booking Pro has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CommuniGate Pro Code Execution

The vulnerability of the CommuniGate Pro mail server is related to a countable loss of significance. Exploiting this vulnerability can allow an attacker to execute arbitrary code and cause service failures...

CommuniGate Pro Path Traversal Unauthorized Access

The vulnerability of the CommuniGate Pro mail server is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by increasing privileges...

CommuniGate Pro Zero Pointer Disclosure

The vulnerability of the CommuniGate Pro mail server is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

AES-128-CBC Buffer Overflow DoS

The vulnerability of the AES-128-CBC encryption algorithm in the microprogramming-based router software Tenda RX2 Pro relates to the repeated use of the Initialization Vector IV during the generation of cryptographic keys. Exploiting this vulnerability could allow a malicious actor to disclose th...

Tenda RX2 Pro Telnet Command Bypass

The vulnerability of the Telnet protocol implementation in Tenda RX2 Pro microprogramming router software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary commands remotely...

Tenda RX2 Pro setLanCfg() Command Execution

The vulnerability of the setLanCfg function in the Tenda RX2 Pro router’s microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Tenda RX2 Pro Telnet Disclosure

The vulnerability of the Telnet protocol implementation in the microprogramming-based router software Tenda RX2 Pro is related to the insecure storage of confidential information. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

AES-128-CBC Buffer Overflow DoS

The vulnerability of the AES-128-CBC encryption algorithm in the microprogramming-based router software Tenda RX2 Pro relates to the storage of encryption keys in an open manner. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

CVE-2025-47787

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation...

CVE-2024-6693

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6690

The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites...

CVE-2024-6693

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...