CVE-2025-27010

CVE-2025-27010 is a Local File Inclusion (path traversal) vulnerability in the WordPress theme Tastyc, affecting versions before 2.5.2. The issue (described as a path traversal flaw) can enable PHP Local File Inclusion via certain input paths. Public sources (Patchstack, Red Hat advisory, NVD/NVD...

SAP Supplier Relationship Management 安全漏洞

SAP supplier relationship management is a supplier relationship management software developed by SAP Germany. An information disclosure vulnerability exists in SAP supplier relationship management, which stems from the use of a deprecated Java applet component, and can be exploited by an attacker...

PostgreSQL DoS Vulnerability (Feb 2025) - Linux

PostgreSQL is prone to a denial of service DoS vulnerability due to a buffer over-read. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Michael in WordPress Plugin Cost Calculator for Elementor versions = 1.3.3...

CVE-2025-4052

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Low...

CVE-2025-46504 WordPress Vasaio QR Code plugin <= 1.2.5 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Olar Marius Vasaio QR Code allows Stored XSS. This issue affects Vasaio QR Code: from n/a through 1.2.5...

CVE-2025-39594 WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Arigato Autoresponder and Newsletter allows Reflected XSS. This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.4...

CVE-2025-39540 WordPress WP Flipclock plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rhys Wynne WP Flipclock wp-flipclock allows DOM-Based XSS.This issue affects WP Flipclock: from n/a through = 1.9.1...

WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page

Exploit Title: WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page Date: 25-01-2024 Exploit Author: Rasime Ekici Vendor Homepage: www.softwareag.com Version: 10.15.0000-0092 Tested on: 10.15.0000-0092 CVE : 2024-23733 Description: The /WmAdmin/,/invoke/vm.server/login...

CVE-2025-26743 WordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through = 1.0.10...

PT-2025-16487

Name of the Vulnerable Software and Affected Versions EV charger affected versions not specified Description An unauthenticated attacker can obtain the EV charger version and firmware upgrading history by knowing the charger ID. Recommendations At the moment, there is no information about a newer...

CVE-2024-11129

An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."...

CVE-2025-31021 WordPress Mobile Smart plugin <= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dolbyuk Mobile Smart mobile-smart allows Reflected XSS.This issue affects Mobile Smart: from n/a through = v1.3.16...

CVE-2025-2469 Debug Messages Revealing Unnecessary Information in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users...

Next.js 13.5.1 < 13.5.7 Cache Poisoning

The version of Next.js installed on the remote host is 13.5.1 prior to 13.5.7 or 14.0.x prior to 14.2.10. It is, therefore, affected by a Cache Poisoning. Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number. No...

CVE-2025-32502 WordPress ePaper Lister for Yumpu plugin <= 1.4.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in lemmentwickler ePaper Lister for Yumpu magazine-lister-for-yumpu allows Stored XSS.This issue affects ePaper Lister for Yumpu: from n/a through = 1.4.0...

Fortinet FortiWeb Directory Traversal (FG-IR-24-474)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-474 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in FortiWeb version 7.6...

Debian dla-4119 : lemonldap-ng - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4119 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4119-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-32179 WordPress Maps for WP Plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in icopydoc Maps for WP allows Stored XSS. This issue affects Maps for WP: from n/a through 1.2.4...

CVE-2025-32146

CVE-2025-32146 affects the WordPress plugin JS Job Manager (affected: v2.0.2 and earlier). The issue is an improper control of filename for PHP include/require, enabling PHP Local File Inclusion (and described as PHP Remote File Inclusion) with an authenticated attacker (Contributor+) to exploit....