CVE-2025-55834

CVE-2025-55834: A Cross Site Scripting vulnerability in JeeWMS v3.7 and earlier exists due to improper handling in logController.do, potentially exposing sensitive information. Affected: JeeWMS prior to 3.8. Impact is information disclosure (per sources). Remediation: upgrade to JeeWMS 3.8 or lat...

CVE-2025-8564

The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

WordPress SKT Addons for Elementor plugin <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin SKT Addons for Elementor versions = 3.7...

PT-2025-36359

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor plugin for WordPress versions prior to 3.8 Description: The SKT Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and...

JeeWMS 安全漏洞

JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. A security vulnerability exists in JeeWMS version 3.7, which originates from SQL injection in the CgReportController API...

SPlayer 安全漏洞

SPlayer is a video player from the Chinese company Shooter Video SPlayer. A security vulnerability exists in SPlayer 3.7 and earlier versions, which stems from a stack-based buffer overflow when processing HTTP responses, and could lead to the execution of arbitrary code...

PT-2025-30744

Name of the Vulnerable Software and Affected Versions Kron PAM versions prior to 3.7 Description Kron PAM is susceptible to a Stored Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts. Recommendatio...

CVE-2025-53259 WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through = 3.7...

CVE-2025-28990 WordPress SNS Vicky theme <= 3.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme SNS Vicky allows PHP Local File Inclusion. This issue affects SNS Vicky: from n/a through 3.7...

WordPress plugin SNS Vicky 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress SNS Vicky theme <= 3.7 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme SNS Vicky versions = 3.7...

CVE-2024-27765

Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component...

CVE-2025-29213

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file...

CVE-2025-29213

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file...

PT-2025-16383 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JEEWMS version 3.7 Description: A zip slip vulnerability in the MigrateForm.java component of the service migrate module allows attackers to execute arbitrary code via a crafted Zip file. This issue can potentially be exploited to gain...

CodeCanyon RISE CRM 3.7.0 - SQL Injection

Exploit Title: CodeCanyon RISE CRM 3.7.0 - SQL Injection Google Dork: N/A Date: September 19, 2024 Exploit Author: Jobyer Ahmed Author Homepage: https://bytium.com Vulnerable Version: 3.7 Patched Version: 3.7.1 Tested on: Ubuntu 24.04, Debian Testing CVE: CVE-2024-8945 Instruction 1. Login to...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr 3.7 and earlier versions that stems from a lack of proper validation of the length of user input...

CVE-2025-22349 WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through = 3.7...

CVE-2024-8857

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-8857 WordPress Auction <= 3.7 - Editor+ Stored XSS

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...