CVE-2024-10713

The CVE-2024-10713 entry concerns szad670401/hyperlpr v3.0 and describes a Denial of Service (DoS) caused by the server failing to handle excessive characters at the end of multipart boundaries. Connected documents confirm the vulnerability is triggered by malformed multipart requests with arbitr...

Drupal Formatter Suite module < 2.1.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Daniel Wehner dawehner in WordPress Module Formatter Suite versions 2.1.0...

WordPress Altair theme <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current vulnerability

Unauthenticated Arbitrary Options Update via ppimportcurrent vulnerability discovered by Tonn in WordPress Theme Altair versions = 5.2.4...

CVE-2025-26961 WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability

Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through = 1.70.0...

CVE-2025-2221 WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection

The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘userphone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2025-1561 AppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress AppPresser plugin <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin AppPresser versions = 4.4.10...

CVE-2025-2169 WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution

The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running...

WordPress HUSKY plugin <= 1.3.6.5 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Hiroho Shimada in WordPress Plugin HUSKY versions = 1.3.6.5...

WordPress WP-Recall plugin <= 16.26.10 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin WP-Recall versions = 16.26.10...

WordPress Greek Multi Tool plugin <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by WordFence in WordPress Plugin Greek Multi Tool – Fix peralinks, accents, auto create menus and more versions = 2.3.1...

Teachers Record Management System 2.1 Cross Site Scripting Vulnerability

Exploit Title: Teachers Record Management System v2.1 | Unauthenticated Cross-Site Scripting XSS Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/ Demo Site:...

Teachers Record Management System 2.1 Cross Site Scripting

Teachers Record Management System version 2.1 suffers from a cross site scripting vulnerability. Exploit Title: Teachers Record Management System v2.1 | Unauthenticated Cross-Site Scripting XSS Date: 2025-03-04 Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor:...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

CVE-2024-50705

Unauthenticated reflected cross-site scripting XSS vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts via the page parameter...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

CVE-2024-50707

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request...

CVE-2024-50707

CVE-2024-50707 is an unauthenticated remote code‑execution in Uniguest Tripleplay prior to version 24.2.1. The issue can be triggered by sending a crafted HTTP GET containing an X-Forwarded-For header, allowing an attacker to execute arbitrary code on affected systems. The CVSS v3.1 base score is...

WordPress GiveWP plugin <= 3.19.4 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by dream hard in WordPress Plugin GiveWP versions = 3.19.4...

GHSA-XR9Q-H9C7-XW8Q Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

Impact An unauthenticated stack overflow crash, leading to a denial of service DoS, was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would...