18446 matches found
CVE-2025-68575 WordPress Wappointment plugin <= 2.7.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through = 2.7.6...
CVE-2025-68530 WordPress Bookory theme <= 2.2.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in pavothemes Bookory bookory allows PHP Local File Inclusion.This issue affects Bookory: from n/a through = 2.2.7...
CVE-2025-68523 WordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through = 5.0.7...
CVE-2022-50701
creationtimestamp| type| source ---|---|--- 2025-12-24 12:22:28+00:00| seen| https://gist.github.com/Darkcrai86/849eb921974288c970abdb2c58358143...
CVE-2022-50704
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free during usb config switch In the process of switching USB config from rndis to other config, if the hardware does not support the -pullup callback, or the hardware encounters a low probability fault...
CVE-2025-14388
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in getExtensionForURL which operates on URL-decoded paths, and appendNormalized...
PT-2025-53353
Name of the Vulnerable Software and Affected Versions Synaccess netBooter NP-0801DU version 7.4 Description The software contains a cross-site request forgery condition that may allow attackers to perform administrative actions without sufficient request validation. An attacker can create malicio...
WordPress plugin Integration for Contact Form 7 HubSpot å®å Øę¼ę“
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin...
PT-2025-53371
Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an...
CVE-2023-53982 PMB 7.4.6 SQL Injection Vulnerability via Unsanitized Storage Parameter
PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-bas...
EUVD-2023-56883
Vulnerability in Tyche softwares Product Delivery Date for WooCommerce ā Lite.This issue affects Product Delivery Date for WooCommerce ā Lite: from n/a through 2.7.0...
CVE-2023-52210 WordPress Product Delivery Date for WooCommerce ā Lite plugin <= 2.7.0 - Broken Access Control vulnerability
Vulnerability in Tyche softwares Product Delivery Date for WooCommerce ā Lite.This issue affects Product Delivery Date for WooCommerce ā Lite: from n/a through 2.7.0...
SUSE CVE-2025-14607
A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to...
Ruoyi å®å Øę¼ę“
Ruoyi is a backend management system by Ruoyi's individual developers. A security vulnerability exists in Ruoyi 4.7.9 and earlier versions, which stems from insufficient input validation in the createTable function in SqlUtil.java, which could lead to a SQL injection attack...
ROS-20251223-7302
Vulnerability in ImageMagick7 related to memory re-release bug. Exploitation of the vulnerability may allow an attacker to cause a denial of service...
Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector
Summary Multiple vulnerabilities were addressed in IBM StreamSets Data Collector version 7.0.0 Vulnerability Details CVEID:CVE-2019-10202 DESCRIPTION: A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485,...
CVE-2025-14800
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'movefiletoupload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the...
Keyfactor SignServer å®å Øę¼ę“
Keyfactor SignServer is a digital signature engine from Keyfactor USA. A security vulnerability exists in Keyfactor SignServer versions prior to 7.2, which stems from an error in the container startup logic and could result in a reset configuration to allowany...
š FortiWeb Fabric Connector 7.6.x SQL Injection / Remote Code Execution
This proof of concept exploit demonstrates a pre-authentication remote SQL injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. The flaw allows unauthenticated attackers to achieve remote code execution through malicious SQL queries in the Authorization header...
CVE-2025-26787
CVE-2025-26787 affects Keyfactor SignServer prior to 7.2. The issue arises from a logic error in the SignServer container startup routine: the Admin CLI command intended to configure certificate access at the initial startup is executed on every container restart, resetting the access policy to "...