CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-26933 WordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through =...

VisiCut code-related vulnerabilities

VisiCut is a tool by Thomas Oster, a personal developer. A security vulnerability exists in VisiCut version 2.1, which stems from unsafe XML deserialization in the loadPlfFile method of VisiCutModel.java, which could lead to code execution...

FTCMS code injection vulnerability

ftcms is a content management system from ftcms Inc. A code injection vulnerability exists in version 2.1 of ftcms, which stems from an incorrect manipulation of the parameter title that could lead to a cross-site scripting attack...

Unifiedtransform Access Control Vulnerability

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0, which stems from an access control error that could lead to teachers updating other teachers' personal data...

CVE-2025-25908

A stored cross-site scripting (XSS) vulnerability exists in tianti v2.3 , a JAVA lightweight CMS solution. The root cause is the improper neutralization of input during web page generation, specifically allowing an attacker to inject a crafted payload into the coverImageURL parameter at the /arti...

Unifiedtransform Cross-Site Scripting Vulnerability

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0, which stems from a cross-site scripting vulnerability in the Create assignment function...

Unifiedtransform Access Control Vulnerability

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0 that stems from improper access control and could lead to students modifying exam rules...

FTCMS injection vulnerability

ftcms is a content management system from ftcms Inc. An injection vulnerability exists in ftcms version 2.1, which stems from the fact that incorrect manipulation of the parameter name can lead to SQL injection...

[SECURITY] Fedora 40 Update: python-spotipy-2.25.1-1.fc40

A light weight Python library for the Spotify Web API...

Sage 200 Spain security vulnerabilities

Sage 200 Spain is a business management software from Sage. A security vulnerability exists in Sage 200 Spain versions prior to 2025.35.000, which stems from an SMB mandatory authentication vulnerability that could lead to an administrator-privileged user obtaining an NTLMv2-SSP hash by changing...

GHSA-P34J-R3CH-C985 Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI. This allows attackers with Agent/Extended Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted...

GHSA-69JQ-QR7W-J7QH FlowiseAI Flowise arbitrary file upload vulnerability

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...

Apollo security vulnerabilities

Apollo is a genome annotation editor open-sourced by Generic Model Organism Database. A security vulnerability exists in Apollo versions prior to 2.8.0 that stems from the presence of a path information disclosure issue...

WordPress WP Click Info plugin <= 2.7.4 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP Click Info versions = 2.7.4...

WordPress Wallet System for WooCommerce plugin <= 2.6.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Tim Coen in WordPress Plugin Wallet System for WooCommerce versions = 2.6.2...

HZManyun Education and Training System Injection Vulnerability

hzmanyun Education and Training System is an education and training system from China Man Yun hzmanyun Company. An injection vulnerability exists in version 2.1 of the hzmanyun Education and Training System, which stems from command injection...

GHSA-PFR4-4397-3HG8 seajs Cross-site Scripting vulnerability

Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package...

CVE-2025-25108 WordPress SW Plus Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shalomworld SW Plus allows Reflected XSS. This issue affects SW Plus: from n/a through 2.1...

CVE-2025-23587 WordPress all-in-one-box-login plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound all-in-one-box-login allows Reflected XSS. This issue affects all-in-one-box-login: from n/a through 2.0.1...