CVE-2025-39379

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Capturly Capturly capturly-optimize-your-website allows PHP Local File Inclusion.This issue affects Capturly: from n/a through = 2.0.1...

CVE-2025-39382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in danielpataki ACF: Google Font Selector acf-google-font-selector-field allows Reflected XSS.This issue affects ACF: Google Font Selector: from n/a through = 3.0.1...

CVE-2025-46501 WordPress Mixcloud Embed <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in biancardi Mixcloud Embed allows Stored XSS. This issue affects Mixcloud Embed: from n/a through 2.2.0...

CVE-2025-46480 WordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows Stored XSS.This issue affects Nepali Post Date: from n/a through = 5.1.1...

CVE-2025-46436

CVE-2025-46436 : Cross-Site Request Forgery in WordPress SCSS-Library (versions

CVE-2025-32921 WordPress Arrival theme <= 1.4.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpoperations Arrival arrival allows PHP Local File Inclusion.This issue affects Arrival: from n/a through = 1.4.5...

WordPress plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

AZL-60936 CVE-2025-46394 affecting package busybox 1.36.1-26

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences...

WordPress Evergreen Content Poster plugin <= 1.4.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by LVT-tholv2k in WordPress Plugin Evergreen Content Poster versions = 1.4.5...

WordPress JNews Theme <= 11.6.16 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme JNews versions = 11.6.16...

CVE-2025-46250

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vikas Ratudi VForm allows Stored XSS. This issue affects VForm: from n/a through 3.1.14...

CVE-2025-46249

Cross-Site Request Forgery CSRF vulnerability in Michael Simple calendar for Elementor allows Cross Site Request Forgery. This issue affects Simple calendar for Elementor: from n/a through 1.6.4...

CVE-2025-46249 WordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through = 1.6.4...

CVE-2025-46242

CVE-2025-46242 — WordPress Watu Quiz plugin &lt;= 3.4.3 SQL Injection Root cause: Improper neutralization of special elements used in SQL commands in Watu Quiz (WordPress plugin). The vulnerability enables SQL Injection in versions up to 3.4.3. Impact: Potential unauthorized access or data manipu...

HPESBHF04830 rev.2 - HPE Superdome Flex, Flex 280 and Compute Scale-up Server 3200 platforms, Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Bypass Security Restrictions, Code Execution, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.55.98 HPE Superdome Flex 280 Server - Prior to v2.00.12...

WordPress CiyaShop theme <= 4.18.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds Patchstack Alliance in WordPress Theme CiyaShop versions = 4.18.0...

SUSE CVE-2025-22046

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampolinecheckip returns address near the bottom of the address space that is allowed to call into the syscall if uretprobes are not set...

CVE-2024-46089

74cms =3.33 is vulnerable to remote code execution RCE in the background interface apiadmin...

CVE-2025-26996

Improper Control of Generation of Code 'Code Injection' vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Code Injection.This issue affects Sign-up Sheets: from n/a through = 2.3.0.1...

CVE-2025-30970

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scottwallick Easy Contact easy-contact allows Reflected XSS.This issue affects Easy Contact: from n/a through = 0.1.2...