CVE-2025-9631

The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatsetajax function. This makes it possible for unauthenticated attackers to trigger automatic...

WordPress BeyondCart Connector plugin <= 3.0.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin BeyondCart Connector versions = 3.0.1...

CVE-2025-58847

Cross-Site Request Forgery CSRF vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a through = 2.1...

CVE-2025-58838

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zakir Smooth Accordion smooth-accordion allows Stored XSS.This issue affects Smooth Accordion: from n/a through = 2.1...

CVE-2025-58790

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through = 2.1.8...

CVE-2025-58847 WordPress WN Flipbox Pro Plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a through = 2.1...

PT-2025-36177

Name of the Vulnerable Software and Affected Versions: Zakir Smooth Accordion versions through 2.1 Description: The software contains a cross-site scripting XSS issue that allows for stored XSS attacks due to improper neutralization of input during web page generation. Recommendations: Update Zak...

CVE-2025-57576

PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php...

batteryKid 安全漏洞

batteryKid is a tool to extend battery life by the individual developer of Alaneuler. A security vulnerability exists in batteryKid 2.1 and earlier versions, which stems from a missing authentication in the file PrivilegeHelper/PrivilegeHelper.swift...

CVE-2025-9409

A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controller/CommonController.go. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack...

Linux Distros Unpatched Vulnerability : CVE-2020-11087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlmreadAuthenticateMessage. This has been fixed in 2.1.0. CVE-2020-11087 Note that...

Linux Distros Unpatched Vulnerability : CVE-2019-12107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The upnpeventprepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper...

CVE-2025-9413 lostvip-com ruoyi-go system_router.go SelectListByPage sql injection

A flaw has been found in lostvip-com ruoyi-go up to 2.1. This impacts the function SelectListByPage of the file modules/system/systemrouter.go. This manipulation of the argument orderByColumn/isAsc causes sql injection. The attack may be initiated remotely. The exploit has been published and may ...

CVE-2025-9412

CVE-2025-9412 affects lostvip-com ruoyi-go up to version 2.1, targeting the file DictDataDao.go in function SelectListByPage . The vulnerability arises from improper handling of the arguments orderByColumn and isAsc , enabling SQL injection via manipulated input. It is remotely exploitable and th...

ruoyi-go 路径遍历漏洞

ruoyi-go is a backend management system for individual developers at lostvip.com. A path traversal vulnerability exists in ruoyi-go 2.1 and earlier versions, which stems from the improper handling of the fileName parameter in the DownloadTmp/DownloadUpload function in the file...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the AESNativeCBC class due to the use of a private instance class, rather than a private static class. An attacker can cause heap exhaustion by triggering excessive memory allocati...

CVE-2025-53998

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Retrieve Embedded Sensitive Data.This issue affects JetWooBuilder: from n/a through = 2.1.20...

CVE-2025-48154

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbgvpyoutubevimeoaddonvisualcomposer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Pa...

CVE-2025-48154

CVE-2025-48154 corresponds to a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder , affecting versions

Linux Distros Unpatched Vulnerability : CVE-2022-47095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevcparsevpsextension function of mediatools/avparsers.c CVE-2022-47095 Note that Ness...