17029 matches found
CVE-2024-12364
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection. This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the...
WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Cron Logger versions = 1.3.0...
CVE-2025-53270
Cross-Site Request Forgery CSRF vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through = 1.7.0...
CVE-2025-24760
CVE-2025-24760 affects the WordPress theme Sofass (Sofass: <= 1.3.4). Described as an unauthenticated Local File Inclusion via Improper Control of Filename for Include/Require, i.e., PHP Remote File Inclusion. CVSS v3.1 base score 8.1 (HIGH) with network attack vector, high impact on confident...
CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...
WordPress BuddyPress Docs plugin < 2.2.5 - Subscriber+ Arbitrary Document Read/Update vulnerability
Subscriber+ Arbitrary Document Read/Update vulnerability discovered by Terrence Bosco, Alexus Bosco, Andrew Risorto in WordPress Plugin BuddyPress Docs versions 2.2.5...
MAL-2025-5362 Malicious code in aquasec-orb-test-project (npm)
The package communicates with a domain associated with malicious activity...
PT-2025-27152 · Unknown · Burst Statistics
Name of the Vulnerable Software and Affected Versions: Burst Statistics versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...
PT-2025-27169 · Unknown · Writesonic
Name of the Vulnerable Software and Affected Versions: Writesonic versions 1.0.0 through 1.0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks...
PT-2025-27189 · Unknown · Thumbnail Editor
Name of the Vulnerable Software and Affected Versions: Thumbnail Editor versions through 2.3.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...
PT-2025-27107 · Arraytics · Arraytics Eventin
Name of the Vulnerable Software and Affected Versions: Arraytics Eventin versions through 4.0.28 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions through...
PT-2025-27231 · Ibm · Ibm Cloud Pak System
Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.6 through 2.3.5.0 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. This issu...
PT-2025-27062 · WordPress · Buddypress Docs
Name of the Vulnerable Software and Affected Versions: BuddyPress Docs WordPress plugin version 2.2.4 and earlier Description: The issue is related to inadequate access controls in the BuddyPress Docs WordPress plugin, allowing a logged-in user to view and download files belonging to another user...
PT-2025-27151 · Tenda · Tenda Ac6
Name of the Vulnerable Software and Affected Versions: Tenda AC6 versions =V15.03.05.19 Description: A buffer overflow issue exists in the fromNatStaticSetting function via the page parameter. Recommendations: For Tenda AC6 versions =V15.03.05.19, update to a version later than V15.03.05.19 to...
PT-2025-27109 · Unknown · Syed Tahir Ali Jan Bulk Youtube Post Creator
Name of the Vulnerable Software and Affected Versions: Syed Tahir Ali Jan Bulk YouTube Post Creator versions 1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks...
PT-2025-27203 · Unknown · Rohil Contact Form – 7 : Hide Success Message
Name of the Vulnerable Software and Affected Versions: Rohil Contact Form – 7 : Hide Success Message versions 1.1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For...
PT-2025-27171 · Unknown · Onet Regenerate Thumbnails
Name of the Vulnerable Software and Affected Versions: ONet Regenerate Thumbnails versions 1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the...
PT-2025-27164 · Unknown · Gmedia Photo Gallery
Name of the Vulnerable Software and Affected Versions: Gmedia Photo Gallery versions 1.23.0 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...
PT-2025-27224 · Unknown · Track Everything
Name of the Vulnerable Software and Affected Versions: Track Everything versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...
PT-2025-27034
Name of the Vulnerable Software and Affected Versions: Flock Safety Gunshot Detection devices versions prior to 1.3 Description: The issue concerns a hard-coded password for a connection in Flock Safety Gunshot Detection devices. This hardcoded password allows for unauthenticated access to the...