WordPress plugin WP Dispatcher 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

CVE-2025-40647

Stored Cross-Site Scripting XSS vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'email' parameter in '/index.php?menu=addressbook'...

CVE-2024-58260

CVE-2024-58260 affects Rancher (Rancher Manager) via missing server-side validation on the .username field, enabling users with update permissions on other User resources to cause denial of access for targeted accounts. Connected documents map this to Rancher/Rancher components and multiple affec...

Stalwart 安全漏洞

stalwart is a versatile email and collaboration server open-sourced by Stalwart Labs. A security vulnerability exists in Stalwart 0.13.3 and earlier versions, which stems from a lack of validation checks in multiple state handlers in the IMAP protocol parser, which could lead to an unbounded memo...

laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import

Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected? You are affected by this vulnerability if you meet the...

CVE-2025-7052

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the changepassword function of its customercabinetchangepassword AJAX route. The plugin hooks this endpoint via wpajax and...

CVE-2025-9948

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...

CVE-2025-7052 LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the changepassword function of its customercabinetchangepassword AJAX route. The plugin hooks this endpoint via wpajax and...

CVE-2025-9948

The CVE-2025-9948 entry corresponds to the WordPress plugin Chat by Chatwee, vulnerable to Cross-Site Forgery (CSRF) on the admin settings page in all versions up to 2.1.3. The root cause is missing or incorrect nonce validation, allowing unauthenticated attackers to modify plugin settings by tri...

CVE-2025-34232

Vasion Print (formerly PrinterLogic) Virtual Appliance Host is affected up to version 25.1.102 and the Application up to 25.1.1413 in VA/SaaS deployments. A blind SSRF is reachable via /var/www/app/console_release/lexmark/dellCheck.php; when a printer is registered, the hostname is stored in $pri...

CVE-2025-10345 HTML injection in Perfex CRM

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'...

CVE-2025-9893

The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vmsettodefault function. This makes it possible for unauthenticated attackers to reset all menu...

PT-2025-39716

Name of the Vulnerable Software and Affected Versions cForms – Light speed fast Form Builder plugin for WordPress versions through 3.0.0 Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the cforms api function. This allows...

PT-2025-39717

Name of the Vulnerable Software and Affected Versions Trust Reviews plugin for WordPress versions prior to 1.0 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is due to missing or incorrect nonce validation in the feed save function. An unauthenticated attacker ca...

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

Impact Because UPDATE validation is not being applied, it is possible for an actor with access to an instance of the initializingworkspaces virtual workspace to run arbitrary patches on the status field of LogicalCluster objects while the workspace is initializing. This allows to add or remove an...

GHSA-Q6HV-WCJR-WP8H kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

Impact Because UPDATE validation is not being applied, it is possible for an actor with access to an instance of the initializingworkspaces virtual workspace to run arbitrary patches on the status field of LogicalCluster objects while the workspace is initializing. This allows to add or remove an...

formbricks 数据伪造问题漏洞

formbricks is an open source survey system from Formbricks. A data forgery issue vulnerability exists in versions prior to formbricks 4.0.1 that stems from a lack of JWT signature validation, which could lead to arbitrary JWT forgery and password resets...

CVE-2025-10548

CVE-2025-10548 affects CleverControl installer software (v11.5.1041.6; prior to 11.5.1041.6 per PT-2025-39149). The root cause is failure to validate TLS server certificates during installation, enabling the installer to download/execute external components via curl.exe --insecure. This can permi...

CVE-2025-9882

The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...

CVE-2025-9883

The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...