2739 matches found
CVE-2025-2636 InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...
WordPress Arkhe Theme <= 3.12.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software Arkhe Type Theme Vulnerable versions = 3.12.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-26748 Patch priority Low CVSS severity Low 8.1 Developer Claim ownership PSID a6776a4c31ac Credits Dimas Maulana Required privileg...
Huawei EulerOS: Security Advisory for python-jinja2 (EulerOS-SA-2025-1375)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-2408 Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information...
WordPress Vice Versa plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Vice Versa versions = 2.2.3...
PT-2025-15985 · Ibm · Ibm Sterling Control Center
Name of the Vulnerable Software and Affected Versions: IBM Sterling Control Center versions 6.2.1 through 6.4.0 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system, potentially exposing sensitive information. Recommendations: For...
Next.js 11.1.4 < 12.3.5 Authorization Bypass
The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware. Note that the scanner has not attempted to...
Moodle 4.2.x < 4.2.4 Multiple Cross-Site Scripting
According to its self-reported version, the Moodle install hosted on the remote host is 4.2.x prior to 4.2.4 or 4.3.x prior to 4.3.1. It is, therefore, affected by multiple cross-site scripting: - Reflected XSS risk on ad-hoc tasks page - Reflected XSS risk in grader report search - Stored XSS in...
Next.js 9.5.5 < 14.2.15 Authorization Bypass
The version of Next.js installed on the remote host is 9.5.5 prior to 14.2.15. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware. Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-report...
Moodle 4.1.x < 4.1.17 Hidden Grades Shown Without Permission
According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.17 or 4.3.x prior to 4.3.11 or 4.4.x prior to 4.4.7 or 4.5.x prior to 4.5.3. It is, therefore, affected by an insufficient capability checks in some grade reports resulted in some hidden grades...
Moodle 4.1.x < 4.1.3 SQL injection
According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.21, 3.11.x prior to 3.11.14, 4.0.x prior to 4.0.8 or 4.1.x prior to 4.1.3. It is, therefore, affected by a limited SQL injection in functionality used by the Wiki activity when listing pages. Note...
Moodle < 3.9.21 SQL injection
According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.21, 3.11.x prior to 3.11.14, 4.0.x prior to 4.0.8 or 4.1.x prior to 4.1.3. It is, therefore, affected by a limited SQL injection in functionality used by the Wiki activity when listing pages. Note...
Moodle 3.11.x < 3.11.14 SQL injection
According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.21, 3.11.x prior to 3.11.14, 4.0.x prior to 4.0.8 or 4.1.x prior to 4.1.3. It is, therefore, affected by a limited SQL injection in functionality used by the Wiki activity when listing pages. Note...
Next.js 14.0.x < 14.2.10 Cache Poisoning
The version of Next.js installed on the remote host is 13.5.1 prior to 13.5.7 or 14.0.x prior to 14.2.10. It is, therefore, affected by a Cache Poisoning. Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number. No...
WordPress Payment Forms for Paystack plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Payment Forms for Paystack versions = 4.0.2...
WordPress Wetterwarner plugin <= 2.7.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Wetterwarner versions = 2.7.3...
WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin ABA PayWay Payment Gateway for WooCommerce versions = 2.1.4...
WordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by LVT-tholv2k in WordPress Plugin Neon Product Designer versions = 2.2.0...
GHSA-X2RG-Q646-7M2V Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Summary In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5. PoC Coming soon... Impact 1. Redirect user to another phishing site 2...
