CVE-2025-12823 CSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

EUVD-2025-197957

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type...

Windu CMS 安全漏洞

Windu CMS Windu CMS is a lightweight web content management system CMS. A security vulnerability exists in Windu CMS version 4.1, which stems from improper access control and could result in a privileged user deleting the Super Administrator...

PT-2025-47367

Name of the Vulnerable Software and Affected Versions kishan0725 Hospital Management System version 4 Description The software contains an Insecure Direct Object Reference IDOR issue within the appointment cancellation functionality. This allows potential unauthorized access and manipulation of...

Hospital Management System 安全漏洞

Hospital Management System is a hospital management software by Pon Aravind Boominathan Individual Developer. A security vulnerability exists in Hospital Management System version v4, which stems from an insecure direct object reference in the Appointment Cancellation feature that could lead to...

EUVD-2025-198032

kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference IDOR vulnerability in the appointment cancellation functionality...

CVE-2025-63513

kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference IDOR vulnerability in the appointment cancellation functionality...

Windu CMS 安全漏洞

Windu CMS Windu CMS is a lightweight web content management system CMS from Windu. A security vulnerability exists in Windu CMS version 4.1, which stems from insufficient client-side brute force protection and could lead to brute force attacks...

PT-2025-47337

Name of the Vulnerable Software and Affected Versions Hospital Management System version 4 Description The Hospital Management System version 4 is susceptible to a SQL Injection issue within the admin-panel1.php file, specifically in the doctor deletion functionality. The application does not...

Hospital Management System 安全漏洞

Hospital Management System is a hospital management software by Pon Aravind Boominathan, an individual developer. A security vulnerability exists in Hospital Management System version v4, which stems from mishandling of the email parameter in admin-panel1.php, which may lead to SQL injection...

Windu CMS 跨站请求伪造漏洞

Windu CMS Windu CMS is a lightweight web content management system CMS from Windu Inc. A cross-site request forgery vulnerability exists in Windu CMS version 4.1, which stems from a CSRF protection mechanism that can be bypassed, potentially leading to cross-site request forgery attacks...

CVE-2025-63513

kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference IDOR vulnerability in the appointment cancellation functionality...

CVE-2025-63512

kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. The application fails to properly sanitize or parameterize user-supplied input from the demail parameter before incorporating it directly into a dynamic SQL que...

WordPress Post Type Switcher plugin <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change vulnerability

Insecure Direct Object Reference to Authenticated Author+ Post Type Change vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Post Type Switcher versions = 4.0.0...

CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitatio...

CVE-2025-12847 All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint...

[SECURITY] Fedora 41 Update: rust-reqsign-aws-v4-2.0.1-1.fc41

AWS SigV4 signing implementation for reqsign...

EUVD-2025-197659

A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file /dashboard/Ccustomer/managecustomer. This manipulation of the argument Search causes cross site scripting. The attack may be initiated...

Slackware Linux 15.0 / current xpdf Multiple Vulnerabilities (SSA:2025-319-01)

The version of xpdf installed on the remote host is prior to 4.06. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-319-01 advisory. New xpdf packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

PT-2025-47041

Name of the Vulnerable Software and Affected Versions All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic versions prior to 4.8.10 Description The All in One SEO plugin for WordPress has a flaw that allows unauthorized deletion of media attachments. The issue stems from ...