PT-2025-33958 · Jorge Garcia De Bustos · Awstats Script

Name of the Vulnerable Software and Affected Versions: AWStats Script versions n/a through 0.3 Description: An improper neutralization of input during web page generation issue, specifically a Stored Cross-site Scripting XSS flaw, exists in Jorge Garcia de Bustos AWStats Script. This allows for t...

CVE-2025-38554

In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma-mm is freed after vma-vmrefcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by...

CVE-2025-9135

A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1258 on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components...

CVE-2025-8783

The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title’ parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-8622 Flexible Maps <= 1.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode

The Flexible Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flexible Maps shortcode in all versions up to, and including, 1.18.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Panda theme <= 1.21 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Panda versions = 1.21...

WordPress MaxCube theme <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme MaxCube versions = 1.3.1...

PT-2025-33720 · Unknown +1 · Busbahnbim +2

Name of the Vulnerable Software and Affected Versions: Verkehrsauskunft Österreich SmartRide versions up to 12.1.1258 cleVVVer versions up to 12.1.1258 BusBahnBim versions up to 12.1.1258 Description: A vulnerability exists related to the improper export of Android application components due to...

CVE-2025-8089

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2025-6221

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-9105 Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scripting

A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhecimento/ of the component Informações Adicionais Page. Such manipulation of the argument Parecer/Conteúdos/Objetivos leads to cross site...

PT-2025-33682 · Undefined · Undefined

@CISACyber Good catch, @AdamRussellW3! CVE-2025-5494854494948 looks serious—thanks for the heads-up. Patching this one ASAP is a no-brainer. Cybersecurity...

PT-2025-33636 · Portabilis · I-Diario

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions up to 1.5.0 Description: A vulnerability exists in Portabilis i-Diario up to version 1.5.0, impacting an unknown function within the /alunos/search autocomplete file. Manipulation of the q argument can lead to...

WordPress Slide Puzzle plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Slide Puzzle versions = 1.0.0...

WordPress Laposta WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin Laposta WooCommerce versions = 1.9.1...

CVE-2025-52765

Cross-Site Request Forgery CSRF vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Stored XSS.This issue affects NetInsight Analytics Implementation Plugin: from n/a through = 1.0.3...

CVE-2025-53587

Cross-Site Request Forgery CSRF vulnerability in ApusTheme Findgo findgo allows Cross Site Request Forgery.This issue affects Findgo: from n/a through = 1.3.57...

CVE-2025-49053

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through = 1.0.5...

CVE-2025-54706

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noor Alam Magical Posts Display magical-posts-display allows DOM-Based XSS.This issue affects Magical Posts Display: from n/a through = 1.2.52...

CVE-2025-52823

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through = 1.16.8...