CVE-2025-13065 Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

CVE-2025-13065 Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

CVE-2025-13065

The CVE-2025-13065 vulnerability affects the WordPress Starter Templates plugin (versions up to and including 4.4.41). Root cause: insufficient file-type validation for WXR uploads allows double extensions to bypass sanitization, enabling an authenticated attacker with author-level access or high...

CVE-2021-2135

creationtimestamp| type| source ---|---|--- 2025-12-06 04:16:04+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-2135.yaml 2025-12-09 21:02:29+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m7lgxdvqlv2w...

WordPress WPKoi Templates for Elementor plugin <= 3.4.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin WPKoi Templates for Elementor versions = 3.4.4...

PT-2025-49358

Name of the Vulnerable Software and Affected Versions WordPress Starter Templates versions up to and including 4.4.41 Description The Starter Templates plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling WXR files. This allows files wi...

WordPress plugin Starter Templates 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

Nuclei 3.6.0

Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives...

SAP-Nuclei-Templates

SAP-Nuclei-Templates Nuclei Templates fo...

CVE-2019-14950

creationtimestamp| type| source ---|---|--- 2025-12-02 16:55:19+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-14950.yaml 2025-12-03 21:02:25+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m74e5q5cp22g...

GHSA-GJC5-8CFH-653X Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)

Summary Grav CMS is vulnerable to a Server-Side Template Injection SSTI that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Details Grav CMS uses a custom sandbox to protect the powerful Twig methods...

Learning the Wrong Lessons: Syntactic-Domain Spurious Correlations in Language Models

Whitepaper from researchers at MIT, Northeastern University, and Meta. For an LLM to correctly respond to an instruction it must understand both the semantics and the domain i.e., subject area of a given task-instruction pair. However, syntax can also convey implicit information Recent work shows...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.7.3 release.

Red Hat Developer Hub 1.7.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

CVE-2018-17082

creationtimestamp| type| source ---|---|--- 2025-12-01 07:51:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2018/CVE-2018-17082.yaml 2025-12-02 21:02:28+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6ztowc7ky2w 2026-01-27...

CVE-2023-2734

creationtimestamp| type| source ---|---|--- 2025-11-30 13:09:53+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-2734.yaml 2025-12-01 21:02:35+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda4wo3z2j...

CVE-2021-36888

creationtimestamp| type| source ---|---|--- 2025-11-29 19:45:46+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-36888.yaml 2025-12-01 21:02:33+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda4o4qo2a 2026-06-23...

CVE-2019-25213

creationtimestamp| type| source ---|---|--- 2025-11-29 18:33:45+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-25213.yaml 2025-12-01 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda4hvzu2e 2025-12-02...

CVE-2025-10211

creationtimestamp| type| source ---|---|--- 2025-11-29 09:41:41+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-10211.yaml 2025-12-01 21:02:40+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda5ntpo2f 2026-02-02...

CVE-2025-10210

creationtimestamp| type| source ---|---|--- 2025-11-29 09:24:53+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-10210.yaml 2025-12-01 21:02:39+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda5kwa52g...

CVE-2025-13742

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when name is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML i...