WordPress GrandPrix Theme <= 1.6 is vulnerable to Local File Inclusion

Software GrandPrix Type Theme Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49296 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID c52f8c6d6e9e Credits Bonds Required privilege Unauthenticated Publishe...

WordPress PayU India plugin < 3.8.8 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin PayU India versions 3.8.8...

WordPress Video Embeds plugin <= 0.1.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Fore-Z co.ltd in WordPress Plugin Video Embeds versions = 0.1.1...

WordPress Quick Event Calendar plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by haudayroi - BlueRock in WordPress Plugin Quick Event Calendar versions = 1.4.9...

WordPress GPP Slideshow plugin <= 1.3.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by HLog in WordPress Plugin GPP Slideshow versions = 1.3.5...

WordPress ThemeHunk plugin <= 1.1.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin ThemeHunk versions = 1.1.2...

WordPress Job Board Manager plugin <= 2.1.60 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Job Board Manager versions = 2.1.60...

WordPress Product Catalog Simple plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Product Catalog Simple versions = 1.8.1...

WordPress Event post plugin <= 5.10.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin Event post versions = 5.10.1...

WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Calculated Fields Form versions = 5.3.58...

WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability

Arbitrary Shortcode Execution vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Team Showcase versions 25.05.13...

WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

Arris VIP1113 安全漏洞

The Arris VIP1113 is a set-top box for HD IPTV services from Arris USA. A security vulnerability exists in the Arris VIP1113 version 2025-05-30 and earlier, which stems from a specially crafted /usr/bin/gunzip file that could lead to arbitrary image booting...

WordPress PIMP - Creative MultiPurpose Theme <= 1.7 is vulnerable to Deserialization of untrusted data

Software PIMP - Creative MultiPurpose Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Deserialization of untrusted data CVE CVE-2025-31398 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID edcf31b181b0 Credits Tran Nguyen Bao Kha...

Arris VIP1113 安全漏洞

The Arris VIP1113 is a set-top box for HD IPTV services from Arris USA. A security vulnerability exists in the Arris VIP1113 version 2025-05-30 and earlier, which stems from a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a...

WordPress Newsletters plugin <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion vulnerability

Authenticated Administrator+ Local File Inclusion vulnerability discovered by m3ssap0 in WordPress Plugin Newsletters versions = 4.9.9.9...

LPASS: Linear Probes As Stepping Stones for Vulnerability Detection Using Compressed LLMs

Large Language Models LLMs are being extensively used for cybersecurity purposes. One of them is the detection of vulnerable codes. For the sake of efficiency and effectiveness, compression and fine-tuning techniques are being developed, respectively. However, they involve spending substantial...

Netgear DGND3700 Improper Authentication Vulnerability

The Netgear DGND3700 is a dual-band Gigabit wireless DSL router manufactured by NETGEAR and is primarily used for home and SMB network connections. The Netgear DGND3700 suffers from an improper authentication vulnerability that originates in an unknown portion of Basic Authentication's file...

WordPress WP Extended plugin <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by rajanhoyr in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.15...

Evaluating AI Cyber Capabilities with Crowdsourced Elicitation

As AI systems become increasingly capable, understanding their offensive cyber potential is critical for informed governance and responsible deployment. However, it's hard to accurately bound their capabilities, and some prior evaluations dramatically underestimated them. The art of extracting...