CVE-2025-60161

CVE-2025-60161: ZoloBlocks (ZoloBlocks plugin)

PT-2025-39418

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.2.0 through 2.3.0 Description Flag Forge improperly manages session invalidation. After a user logs out, they can still access protected endpoints, such as /api/profile, and CSRF tokens remain valid. This allows continued...

CVE-2025-59833 FlagForgeCTF Hint Exposure via API

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

CVE-2025-59833

Flag Forge CTI platform vulnerable versions 2.1.0–2.2.9 expose hints in plaintext within the GET /api/problems/:id response, revealing unreleased hints regardless of deduction. This information disclosure undermines business logic and challenge integrity. The issue is patched in version 2.3.0. Re...

CVE-2025-57979

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through = 2.3...

CVE-2025-57979

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through = 2.3...

CVE-2025-58230 WordPress ZoloBlocks plugin <= 2.3.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bdthemes ZoloBlocks zoloblocks allows DOM-Based XSS.This issue affects ZoloBlocks: from n/a through = 2.3.12...

CVE-2025-58232 WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through = 2.3.8...

PT-2025-38966

Name of the Vulnerable Software and Affected Versions PickPlugins Accordion versions through 2.3.14 Description The PickPlugins Accordion software contains a flaw related to missing authorization, allowing exploitation of incorrectly configured access control security levels. Recommendations Upda...

WordPress WP Hotel Booking plugin < 2.2.3 - Subscriber+ Rating Manipulation vulnerability

Subscriber+ Rating Manipulation vulnerability discovered by Muhammed Çelik in WordPress Plugin WP Hotel Booking versions 2.2.3...

CVE-2025-59424 LinkAce Vulnerable to Stored XSS on the Audit Page

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...

CVE-2025-7826

The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

WordPress plugin Analytics Reduce Bounce Rate 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

ISC Stork 安全漏洞

ISC Stork is a web management platform for the ISC organization. A security vulnerability exists in ISC Stork version 2.3.0 and earlier, which stems from a large amount of data sent by an unauthenticated user could lead to memory and disk usage issues...

PT-2025-37017

Name of the Vulnerable Software and Affected Versions: Testimonial plugin for WordPress versions prior to 2.3 Description: The Testimonial plugin for WordPress is susceptible to SQL Injection via the iNICtestimonial shortcode. This is due to insufficient escaping on the user-supplied parameter an...

Linux Distros Unpatched Vulnerability : CVE-2020-29657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In JerryScript 2.3.0, there is an out-of-bounds read in mainprintunhandledexception in the main-utils.c file. CVE-2020-29657 Note that Nessus relies on the...

WordPress Fortunio Theme <= 2.3 is vulnerable to Local File Inclusion

Software Fortunio Type Theme Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID f020033c340b Credits Bonds Required privilege Unauthenticated Published 8...

Malicious code in @navify-platform/idle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d4c05f7983c6a597941a36c8177f63342feee29acb5d3922471e2fa25da4f159 The OpenSSF Package Analysis project identified '@navify-platform/idle' @ 2.3.0 npm as malicious. It is considered malicious because: - The...

CVE-2025-31425

Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through 2.6...

PT-2025-33509

Name of the Vulnerable Software and Affected Versions: Apple Music Classical versions prior to 2.3 Description: The issue was addressed with improved checks. An application may be able to unexpectedly leak a user's credentials. Recommendations: Update to Apple Music Classical version 2.3 or later...