18434 matches found
WordPress plugin integration for Contact Form 7 HubSpot security vulnerabilities
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
PT-2026-4401
Name of the Vulnerable Software and Affected Versions CRM Perks Integration for Contact Form 7 HubSpot versions n/a through 1.4.3 Description The CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot contains a flaw that allows retrieval of embedded sensitive data. This issue relates to th...
PT-2026-4445
Name of the Vulnerable Software and Affected Versions Ecwid Shopping Cart versions through 7.0.5 Description The Ecwid Shopping Cart software contains a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access. The issue is a missing...
7-Zip path traversal vulnerability
7-Zip is an open-source compression software developed by 7-Zip. 7-Zip has a path traversal vulnerability; this vulnerability stems from directory traversal during the ZIP file parsing process, which may lead to remote code execution...
Oracle Linux 7 : libpng (ELSA-2026-0251)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-0251 advisory. 2:1.5.13-8.0.1 - Fix CVE-2025-64720 Orabug: 38824465 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...
CVE-2026-24129
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute arbitrary system commands on the host server by injecting shell metacharacters into backup filenames. The BackupManage...
CVE-2026-24129
Runtipi (Docker-based homeserver) versions 3.7.0+ are vulnerable to authenticated arbitrary command execution via shell metacharacters injected into backup filenames. The BackupManager stores uploaded backups using the raw originalname on the host filesystem, allowing an attacker to stage a file ...
CVE-2026-24381
Server-Side Request Forgery SSRF vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through 5.7.2...
CVE-2026-24367
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.8...
CVE-2025-68900
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects Enfold: from n/a through 7.1.3...
CVE-2026-24381
CVE-2026-24381 is a SSRF in PhotoMe photome (WordPress theme/plugin) affecting PhotoMe versions before 5.7.2. Public disclosures in multiple feeds confirm an unauthenticated SSRF; Red Hat, CIRCL, NVD, and Wordfence reference this entry. The issue targets the PhotoMe photome component; remediation...
CVE-2026-24381 WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through 5.7.2...
CVE-2026-22470
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin allows Blind SQL Injection.This issue affects FireStorm Professional Real Estate: from n/a through = 2.7.11...
CVE-2025-69180
CVE-2025-69180 corresponds to a SQL injection in the WordPress Ultra Portfolio plugin (<= v6.7). The issue arises from improper neutralization of input in the Ultra Portfolio plugin, enabling a Blind SQL Injection under authenticated conditions (Authenticated/Subscriber+). Impact is rated High...
CVE-2025-69180 WordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through = 6.7...
CVE-2025-69180
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through = 6.7...
CVE-2025-69102
CVE-2025-69102 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin WP Test Email (wp-test-email) versions up to and including 1.1.7. The issue is described as improper neutralization of input during web page generation, enabling reflected XSS. Public references ...
CVE-2025-69100 WordPress North theme <= 5.7.5 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.This issue affects North: from n/a through = 5.7.5...
CVE-2025-69100
CVE-2025-69100 corresponds to a Local File Inclusion (LFI) in the WordPress theme North (North: <= 5.7.5) due to Improper Control of Filename for Include/Require in PHP. The incident is publicly documented by NVD/Red Hat/CVE listings, with CVSS v3.1 base score 8.1 (Network, high severity, no p...
CVE-2025-69100
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.This issue affects North: from n/a through = 5.7.5...