CVE-2025-2561 Ninja Forms < 3.10.1 - Admin+ Stored XSS

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress My Sticky Bar plugin < 2.6.8 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin My Sticky Bar versions 2.6.8...

CVE-2024-12812

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees...

WordPress Robo Gallery plugin < 3.2.22 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Robo Gallery versions 3.2.22...

Mozilla Firefox ESR < 115.23.1

The version of Firefox ESR installed on the remote Windows host is prior to 115.23.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-38 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index...

WordPress Jetpack plugin < 13.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Marc Montpas in WordPress Plugin Jetpack versions 13.8...

CVE-2025-40907 FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC...

CVE-2024-54779

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds is vulnerable to Cross Site Scripting XSS in widgets/log.widget.php...

Adobe Substance 3D Painter 11.0.1 (APSB25-38)

The version of Adobe Substance 3D Painter installed on the remote host is prior to 11.0.1. It is, therefore, affected by a vulnerability as referenced in the APSB25-38 advisory. - Substance3D - Painter versions 11.0 and earlier are affected by an out-of-bounds write vulnerability that could resul...

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11. An upgraded version of the package is available that resolves this issue...

CVE-2023-25567 affecting package gssntlmssp for versions less than 1.3.1-1

CVE-2023-25567 affecting package gssntlmssp for versions less than 1.3.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-8009

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page...

CVE-2024-2869 Easy Property Listings <= 3.5.3 - Admin+ Stored XSS

The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5440 If-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSS

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2025-4591

CVE-2025-4591 refers to a Stored Cross-Site Scripting vulnerability in the WordPress plugin Weluka Lite (versions up to and including 1.0.3) via the weluka-map shortcode. An authenticated attacker with contributor-level access can inject script that executes on pages viewed by users. Technical de...

CVE-2025-3600 Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service...

CVE-2025-3834

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report...

CVE-2025-4658 Authentication Bypass in OPKSSH

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and...

CVE-2025-33024

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.5, RUGGEDCOM ROX MX5000RE All versions V2.16.5, RUGGEDCOM ROX RX1400 All versions V2.16.5, RUGGEDCOM ROX RX1500 All versions V2.16.5, RUGGEDCOM ROX RX1501 All versions V2.16.5, RUGGEDCOM ROX RX1510 All versions V2.16.5...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...