CVE-2022-47425 WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control

Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10...

CVE-2022-47425

ARMember for WordPress

CVE-2025-22420

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22420

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CERTFR-2025-ACT-054

creationtimestamp| type| source ---|---|--- 2025-12-08 13:34:12+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m7i5gw5sie23 2025-12-08 13:34:13+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115684203023191377 2025-12-08 14:44:49+00:00| seen|...

Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI

The FBI has warned about a new type of scam where your Facebook pictures are harvested to act as “proof-of-life” pictures in a virtual kidnapping. The scammers pretend they have kidnapped somebody and contact friends and next of kin to demand a ransom for their release. While the alleged victim i...

CVE-2025-42620

In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting XSS. On the backend, the relatedvulnerabilities field of bundles accepted arbitrary strings without format validation or proper...

GHSA-9QR9-H5GF-34MP

creationtimestamp| type| source ---|---|--- 2025-12-03 16:43:56+00:00| seen| https://bsky.app/profile/hnws.bsky.social/post/3m73vpks5fm2i 2025-12-03 17:00:30+00:00| seen| https://bsky.app/profile/hnbot.gsuscs.xyz/post/3m73wn646xc2m 2025-12-03 17:07:45+00:00| seen|...

CVE-2025-48631

creationtimestamp| type| source ---|---|--- 2025-12-02 11:03:43+00:00| seen| https://bsky.app/profile/securityrss.bsky.social/post/3m6ysabxve527 2025-12-02 11:23:04+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3m6ytc4pph22v 2025-12-02 11:23:05+00:00| seen|...

ASB-A-337775777

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Socomec Easy Config System User profile management authentication bypass vulnerability

Talos Vulnerability Report TALOS-2024-2117 Socomec Easy Config System User profile management authentication bypass vulnerability December 1, 2025 CVE Number CVE-2024-45370 SUMMARY An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config...

Socomec Easy Config System 安全漏洞

Socomec Easy Config System is a free software tool developed by Socomec for fast, reliable and flexible configuration of its power monitoring and measurement equipment. An authentication bypass vulnerability exists in Socomec Easy Config System, which stems from an authentication bypass in the us...

CVE-2025-41087

Cross-Site Scripting XSS vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of an...

CVE-2025-64067

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...

EUVD-2025-199636

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...

CVE-2025-64067

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...

CERTFR-2025-ACT-050

creationtimestamp| type| source ---|---|--- 2025-11-24 14:16:42+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m6ezbyzdja27 2025-11-24 14:16:45+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115605097721082231 2025-11-24 15:31:12+00:00| seen|...

PT-2025-47899

Cross-Site Scripting XSS vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of an...

CVE-2025-31216

The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may be able to override managed Wi-Fi profiles...

EUVD-2025-198516

The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to override managed Wi-Fi profiles...