CVE-2025-49300

Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through = 2.8...

CVE-2025-49300 WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through = 2.8...

PT-2025-50633

Name of the Vulnerable Software and Affected Versions EasyImages versions 2.0 through 2.8.6 Description An arbitrary file upload issue exists in the /admin/manager.php component. This allows attackers to potentially execute arbitrary code by uploading a specially crafted PHP file. Recommendations...

CVE-2025-67510

Neuron is a PHP framework for AI Agents. Versions 2.8.11 and earlier have a vulnerability in the MySQLWriteTool that can execute arbitrary SQL provided by the caller via PDO::prepare() and execute(), without semantic restrictions. In an LLM/agent context this enables prompt injection or indirect ...

📄 Palo Alto Deep Packet Inspection Information Disclosure

Proof of concept code for Palo Alto deep packet inspection data exfiltration issues that appear to affect PanOS up to version 11.2.0. ============================================================================================================================================= | Title : Palo Alto...

CVE-2025-63052 WordPress SimpLy Gallery plugin <= 3.3.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through = 3.3.2.1...

CVE-2025-66527

CVE-2025-66527: WordPress Lobo theme (versions

PT-2025-50041

Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through = 2.8.7...

Oracle Linux 8 : gimp:2.8 (ELSA-2025-22417)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-22417 advisory. - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - f...

Masa CMS 授权问题漏洞

Masa CMS is a digital experience platform. An authorization issue vulnerability exists in Masa CMS versions prior to 7.2.8, prior to 7.3.13, and prior to 7.4.6, which stems from host header poisoning and could lead to an account takeover via a password reset email...

PT-2025-48945

Name of the Vulnerable Software and Affected Versions Masa CMS versions prior to 7.2.8 Masa CMS versions prior to 7.3.13 Masa CMS versions prior to 7.4.6 Description Masa CMS is susceptible to a host header poisoning issue that can lead to account takeover through the password reset email...

Fedora 43 : glib2 (2025-bab973d0b9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-bab973d0b9 advisory. Update to 2.86.2 Fix CVE-2025-13601 or YWH-PGM9867-134 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

CVE-2025-65952

Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This...

EUVD-2025-199659

Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This...

EUVD-2025-199538

Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unintended operations may be performed...

Sony SNC-CX600W 跨站请求伪造漏洞

The Sony SNC-CX600W is a wireless network HD camcorder from Sony Japan. A cross-site request forgery vulnerability exists in the Sony SNC-CX600W prior to version 2.8.0, which stems from susceptibility to a cross-site request forgery attack that could result in the execution of an unintended...

CVE-2025-13588

A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Performing manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and...

WordPress Mstore Mobile App plugin <= 2.08 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Mstore Mobile App versions = 2.08...

CVE-2025-13588 lKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery

A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Performing manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and...

Streamity.tv 代码问题漏洞

Streamity.tv is an advanced IPTV web player by E M Individual Developer. A code issue vulnerability exists in Streamity.tv version 2.8 and earlier, which stems from a misbehavior in the file public/proxy.php and could lead to server-side request forgery...