4045 matches found
CVE-2025-10586: Improper Neutralization of Special Elements used in an SQL Command
The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘eventvenue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2025-10494
CVE-2025-10494 affects the Motors – Car Dealership & Classified Listings Plugin for WordPress (versions up to 1.4.89). The root cause is insufficient validation of file paths when deleting profile pictures, allowing an authenticated attacker with Subscriber-level access or higher to delete arbitr...
CVE-2025-10494: External Control of File Name or Path
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with...
CVE-2025-10635: Undefined Security Weakness
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks...
CVE-2025-10587: Improper Neutralization of Special Elements used in an SQL Command
The Community Events plugin for WordPress is vulnerable to SQL Injection via the eventcategory parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
EUVD-2020-30786
Malware in sbrugna...
CVE-2025-9243: Missing Authorization
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the getccorders and updateorderstatus functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with...
CVE-2025-8726: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppauserupload function. This makes it possible for authenticated attackers, with Subscriber-level...
EUVD-2024-32436
Malicious code in bioql PyPI...
EUVD-2024-17419
Malicious code in bioql PyPI...
EUVD-2024-51731
Malicious code in bioql PyPI...
EUVD-2024-33903
Malicious code in bioql PyPI...
EUVD-2024-34347
Malicious code in bioql PyPI...
EUVD-2024-33332
Malicious code in bioql PyPI...
EUVD-2024-33407
Malicious code in bioql PyPI...
EUVD-2024-51000
Malicious code in bioql PyPI...
EUVD-2024-47751
Malicious code in bioql PyPI...
EUVD-2024-49173
Malicious code in bioql PyPI...