CVE-2025-66134

Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through = 6.5.1...

SUSE CVE-2025-40363

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix field-spanning memcpy warning in AH output Fix field-spanning memcpy warnings in ah6output and ah6outputdone where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings about...

PT-2025-51926

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM, an open-source church management system, contains a SQL injection issue. The vulnerability resides in the src/CartToFamily.php file, specifically in the handling of the PersonAddress POS...

PT-2025-51816

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /webp-converter/v1/regenerate-attachment REST endpoint in all versions up to, and including, 6.3.2. This makes it possib...

PT-2025-51869

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the src/UserEditor.php file. When an administrator saves a user’s configuration settings, the keys of the type...

CVE-2025-13823

A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go into recoverable fault with fault code 0xFE60. To recover the controller, clear the fault...

CVE-2025-67751

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-67874

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other...

CVE-2025-67751

ChurchCRM prior to version 6.5.0 contains a SQL injection in EventEditor.php. When creating a new event and selecting an event type, the EN_tyid POST parameter is not sanitized, allowing an authenticated user with event management permissions (isAddEvent) to execute arbitrary SQL queries. The iss...

CVE-2025-67874 ChurchCRM has plaintext password return in response

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other...

PT-2025-51560

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete any file on the server using path traversal in the ilog script. This script is being run with root...

WordPress plugin WP Compress for MainWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...

CVE-2025-40111 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40111 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-40321 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40321 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-40331 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40331 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-13823 Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities

A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go into recoverable fault with fault code 0xFE60. To recover the controller, clear the fault...

CVE-2025-13823

CVE-2025-13823 affects Rockwell Automation Micro850 and Micro870 controllers in their IPv6 stack. When receiving multiple malformed packets during fuzzing, the controllers enter a recoverable fault with fault code 0xFE60. To recover, the fault must be cleared. Several connected advisories corrobo...

Kodezen Academy LMS 安全漏洞

Kodezen Academy LMS is a Learning Management System from Kodezen Inc. in the United States. A security vulnerability exists in Kodezen Academy LMS version 6.1, which stems from a file upload vulnerability that could lead to the upload of malicious SVG files and the execution of stored cross-site...

EUVD-2025-203288

A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalogadd.php. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...

CVE-2025-14648

A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalogadd.php. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...