CVE-2025-31360

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...

CVE-2025-26857

Unauthenticated attackers can rename arbitrary devices of arbitrary users i.e., EV chargers...

CVE-2025-3479

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handlestripesingle' function due to insufficient validation on a user controlled key. This makes it possible for...

CVE-2025-3479 Forminator <= 1.42.0 - Order Replay Vulnerability

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handlestripesingle' function due to insufficient validation on a user controlled key. This makes it possible for...

CVE-2025-3479

Forminator Forms – Contact Form, Payment Form & Custom Form Builder for WordPress is vulnerable to an Order Replay flaw (CVE-2025-3479) in versions up to 1.42.0 due to insufficient validation of a user-controlled key in the handle_stripe_single path. This allows an unauthenticated attacker to reu...

CVE-2025-3479 Forminator <= 1.42.0 - Order Replay Vulnerability

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handlestripesingle' function due to insufficient validation on a user controlled key. This makes it possible for...

Vulnerability fixed in Cisco Webex App

Cisco has fixed a vulnerability in the Cisco Webex App. The vulnerability is in the way the Cisco Webex App handles its custom URL parser. Unauthenticated remote malicious actors can exploit this vulnerability to trick users into downloading arbitrary files, which can lead to unauthorized command...

CVE-2025-3104

The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest function. This makes it possible for unauthenticated attackers to reveal outdated installed...

CVE-2025-3104 WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function

The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest function. This makes it possible for unauthenticated attackers to reveal outdated installed...

CVE-2025-3247

CVE-2025-3247 – Contact Form 7 (WordPress) is a vulnerability in all versions up to and including 6.0.5 where insufficient validation in the wpcf7_stripe_skip_spam_check key allows an unauthenticated attacker to replay a single Stripe PaymentIntent across multiple transactions. The first transact...

CVE-2025-3247 Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7stripeskipspamcheck' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe...

CVE-2024-13452

The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.29. This is due to missing or incorrect nonce validation on a saveAsCopy function. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-31147

Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users...

CVE-2025-30512

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...

CVE-2025-27719

Unauthenticated attackers can query an API endpoint and get device details...

CVE-2025-27561

Unauthenticated attackers can rename "rooms" of arbitrary users...

CVE-2025-26857

Unauthenticated attackers can rename arbitrary devices of arbitrary users i.e., EV chargers...

CVE-2025-27929 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

CVE-2025-24315 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can add devices of other users to their scenes or arbitrary scenes of other arbitrary users...

CVE-2025-30257

CVE-2025-30257 relates to Growatt Cloud portal authorization bypass through a user-controlled key. The included connected records confirm that unauthenticated attackers can retrieve the serial number of smart meters associated with a specific user account, indicating an information disclosure vul...