CVE-2025-49300 WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through = 2.8...

PT-2025-50633

Name of the Vulnerable Software and Affected Versions EasyImages versions 2.0 through 2.8.6 Description An arbitrary file upload issue exists in the /admin/manager.php component. This allows attackers to potentially execute arbitrary code by uploading a specially crafted PHP file. Recommendations...

CVE-2025-67510

Neuron is a PHP framework for AI Agents. Versions 2.8.11 and earlier have a vulnerability in the MySQLWriteTool that can execute arbitrary SQL provided by the caller via PDO::prepare() and execute(), without semantic restrictions. In an LLM/agent context this enables prompt injection or indirect ...

CVE-2025-66527

CVE-2025-66527: WordPress Lobo theme (versions

PT-2025-50041

Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through = 2.8.7...

CVE-2025-65952

Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This...

EUVD-2025-199659

Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This...

Sony SNC-CX600W 跨站请求伪造漏洞

The Sony SNC-CX600W is a wireless network HD camcorder from Sony Japan. A cross-site request forgery vulnerability exists in the Sony SNC-CX600W prior to version 2.8.0, which stems from susceptibility to a cross-site request forgery attack that could result in the execution of an unintended...

WordPress Mstore Mobile App plugin <= 2.08 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Mstore Mobile App versions = 2.08...

CVE-2025-13588 lKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery

A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Performing manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and...

Streamity.tv 代码问题漏洞

Streamity.tv is an advanced IPTV web player by E M Individual Developer. A code issue vulnerability exists in Streamity.tv version 2.8 and earlier, which stems from a misbehavior in the file public/proxy.php and could lead to server-side request forgery...

CVE-2025-12170

The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wpajaxnoprivcheckboxcleanlog' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files...

UBUNTU-CVE-2025-46705

A denial of service vulnerability exists in the gassertnotreached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...

CVE-2025-46705

CVE-2025-46705 affects Entr'ouvert Lasso (notably 2.5.1 and 2.8.2). A malformed SAML assertion/response can trigger denial of service. Connected advisories (Debian, openSUSE/SUSE, Ubuntu) confirm multiple Lasso CVEs (including 46404, 46784, 47151) with fixes in various package versions (e.g., Deb...

PT-2025-45103

Name of the Vulnerable Software and Affected Versions Ad Inserter versions up to and including 2.8.7 Description The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is susceptible to Stored Cross-Site Scripting through a custom field via the plugin’s adinserter shortcode. Insufficient...

Entr'ouvert Lasso lasso_node_impl_init_from_xml type confusion vulnerability

Talos Vulnerability Report TALOS-2025-2193 Entr'ouvert Lasso lassonodeimplinitfromxml type confusion vulnerability November 5, 2025 CVE Number CVE-2025-47151 SUMMARY A type confusion vulnerability exists in the lassonodeimplinitfromxml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A special...

WordPress plugin MSN Partner Hub 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

EUVD-2025-29077

Malicious code in bioql PyPI...

CVE-2025-10328

CVE-2025-10328 affects MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The vulnerability stems from improper handling of the File argument in the file /htdocs/api/playlist/playsinglefile.php , enabling os command injection. The issue can be exploited remotely and has been publicly disclosed. Mult...

CVE-2025-58800

Cross-Site Request Forgery CSRF vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Email Template: from n/a through = 2.8.5...