18452 matches found
CVE-2025-11955 Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid...
EUVD-2025-36160
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid...
First Wap: A Surveillance Computer You’ve Never Heard Of
Mother Jones has a long article on surveillance arms manufacturers, their wares, and how they avoid export control laws: Operating from their base in Jakarta, where permissive export laws have allowed their surveillance business to flourish, First Wap's European founders and executives have quiet...
CVE-2025-12251
OpenWGA 7.11.12 Build 737 — vulnerability in the Admin UI component enables cross-site scripting. The issue affects the Admin UI function; root cause is a flaw that allows remote execution of scripts. Impact is client-side data integrity/defense separation with potential for arbitrary script exec...
EUVD-2025-36121
Stored cross-site scripting XSS vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can...
WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Consulting versions 6.7.5...
EUVD-2025-35990
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through = 7.3.0...
CVE-2025-62915
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through = 1.4.0...
CVE-2025-62884
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through = 7.2.0...
CVE-2025-58918 WordPress Entrada theme <= 5.7.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7...
EUVD-2025-36062
Cross-Site Request Forgery CSRF vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7...
CVE-2025-58918
CVE-2025-58918 – CSRF in Waituk Entrada Theme (WordPress) A Cross-Site Request Forgery vulnerability affects the Waituk Entrada WordPress theme (versions up to and including 5.7.7). The issue is documented across multiple sources (NVD/Red Hat/CIRCL/CVEs list) with the same description. No exploit...
CVE-2025-62974
CVE-2025-62974 affects the WordPress Headline Analyzer plugin (headline-analyzer) up to version 1.3.7. The issue is a Stored XSS due to improper neutralization of input during web page generation. Documents consistently describe the vulnerability as enabling stored cross-site scripting in Headlin...
CVE-2025-62952 WordPress ChatBot plugin <= 7.7.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through = 7.7.3...
CVE-2025-62930
CVE-2025-62930 concerns WordPress MapSVG plugin MapsVG-Lite-Interactive-Vector-Maps. Affected software: MapSVG (MapsVG) – Vector maps, Image maps, Google Maps; vulnerable component: mapsvg-lite-interactive-vector-maps. Root cause: improper neutralization/validation of input during web page genera...
CVE-2025-62930 WordPress MapSVG plugin <= 8.7.22 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through = 8.7.22...
CVE-2025-62925 WordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through = 7.2.13...
CVE-2025-62915 WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through = 1.4.0...
CVE-2025-62884
CVE-2025-62884 affects the WordPress Coupon Affiliates plugin (woo-coupon-usage) with broken access control due to Missing Authorization, impacting versions up to 7.0.3 (some sources cite up to 7.2.0). The issue enables access to functionality not constrained by ACLs. Base metrics indicate CVSS v...