FreshRSS 安全漏洞

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. A security vulnerability exists in FreshRSS versions 1.26.3 and earlier, which stems from an improperly set path in the subject field and could lead to a directory enumeration attack...

CVE-2025-11028

A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploite...

WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by theviper17 in WordPress Plugin WordPress Image shrinker versions = 1.1.0...

CVE-2025-60181

Server-Side Request Forgery SSRF vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through = 0.6...

CVE-2025-60123

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through = 1.1.3...

CVE-2025-60113

Cross-Site Request Forgery CSRF vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through = 1.4.3...

CVE-2025-9944 Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending

The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the watchforcontactformsubmit function. This makes it possible for unauthenticated attackers to trigg...

WordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Popular Posts by Webline versions = 1.1.1...

PT-2025-39717

Name of the Vulnerable Software and Affected Versions Trust Reviews plugin for WordPress versions prior to 1.0 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is due to missing or incorrect nonce validation in the feed save function. An unauthenticated attacker ca...

WordPress Ninja Forms plugin <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update vulnerability

Cross-Site Request Forgery to Plugin Settings Update vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Ninja Forms versions = 3.12.0...

WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability

Content Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Norebro Extra versions = 1.6.8...

WordPress Workreap (theme's plugin) plugin <= 3.3.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Workreap theme's plugin versions = 3.3.5...

OESA-2025-2346 apache-mime4j security update

Java stream based MIME message parser. Security Fixes: A vulnerability was found in Apache James MIME4J up to 0.8.8. It has been rated as problematic.Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have...

CVE-2025-11010 vstakhov libucl ucl_util.c ucl_include_common heap-based overflow

A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function uclincludecommon of the file /src/uclutil.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the...

WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin GST for WooCommerce versions = 2.0...

WordPress WP Subscription Forms PRO Plugin <= 2.0.5 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WP Subscription Forms PRO versions = 2.0.5...

WordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan in WordPress Plugin MWW Disclaimer Buttons versions = 3.41...

WordPress Subscribe To Unlock Plugin <= 1.1.5 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Subscribe To Unlock versions = 1.1.5...

WordPress Notely Plugin <= 1.8.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Notely versions = 1.8.0...

WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Abu Hurayra in WordPress Plugin aThemes Addons for Elementor versions = 1.1.2...