EUVD-2025-38362

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxaweberlogreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with...

CVE-2025-12167 Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxaweberlogreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with...

CVE-2025-12167

CVE-2025-12167 affects the WordPress plugin “Contact Form 7 AWeber Extension” (versions through 0.1.42). The root cause is a missing capability check on the AJAX endpoint named wp_ajax_aweber_logreset, allowing authenticated users with Subscriber-level access and above to modify data by resetting...

CVE-2025-12167 Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxaweberlogreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with...

CVE-2025-64491 SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting XSS. Successful exploitation could lead to full account takeover, for example by altering the login form to send...

PT-2025-46142

Name of the Vulnerable Software and Affected Versions QNAP HBS 3 Hybrid Backup Sync versions prior to 26.2.0.938 Description A flaw exists in QNAP HBS 3 Hybrid Backup Sync related to incorrect path restriction for an access-limited directory. Successful exploitation by a remote attacker could lea...

PT-2025-45524

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and below Description SuiteCRM is an open-source Customer Relationship Management CRM software application. Versions 7.14.7 and below are susceptible to unauthenticated reflected Cross-Site Scripting XSS. Exploitation ...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions 7.14.7 and earlier and 8.0.0-beta.1 through 8.9.0, which stems from a user session not being disabled when the account is deactivated, which could result in elevated...

WordPress plugin Contact Form 7 AWeber Extension 安全漏洞

WordPress Contact Form 7 AWeber Extension plugin is an extension plugin designed for WordPress Contact Form 7 plugin for automatic synchronization of form data to AWeber email marketing platform. The WordPress Contact Form 7 AWeber Extension plugin suffers from an unauthorized data modification...

WordPress plugin Quick Featured Images SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A SQL injection...

CVE-2025-64481

creationtimestamp| type| source ---|---|--- 2025-11-07 22:25:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m534nqv7yx2n 2025-11-07 23:27:33+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m537znyucqe2...

EUVD-2025-38284

An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QuMagie 2.7.0 and later...

CVE-2025-54737

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through = 4.7.8...

CVE-2025-53283

Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag File Uploader Addon:...

K000157330: Intel 700 Series Ethernet vulnerability CVE-2025-25273

Security Advisory Description Insufficient control flow management in the Linux kernel-mode driver for some IntelR 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2025-25273 Impact There is no impact; F5...

CVE-2025-52425

CVE-2025-52425 describes an SQL injection in QuMagie. A remote attacker could execute unauthorized code/commands. The vulnerability is fixed in QuMagie 2.7.0 and later. CVSS-based metrics indicate critical risk (Network attack, no authentication, high confidentiality/integrity/availability impact...

CVE-2025-58464

Summary: CVE-2025-58464 affects QuMagie with a relative path traversal vulnerability. Multiple sources (NVD, Red Hat, ENISA EUVD) describe a flaw that could allow a remote attacker to read contents of unexpected files or system data. Affected software: QuMagie (prior to version 2.7.3). Vulnerabil...

CVE-2025-61994

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page...

PT-2025-45436

Name of the Vulnerable Software and Affected Versions QuMagie versions prior to 2.7.3 Description A relative path traversal issue exists in QuMagie. A remote attacker may be able to read the contents of unexpected files or system data by exploiting this issue. Recommendations Update to QuMagie...

AlmaLinux 9 : redis:7 (ALSA-2025:19345)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:19345 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...