3408 matches found
CVE-2025-32291
Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through 11.1.0...
CVE-2025-26592
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Lab lab allows PHP Local File Inclusion.This issue affects Lab: from n/a through = 1.0.0...
CVE-2023-26005 WordPress Fitrush <= 1.3.4 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Fitrush allows PHP Local File Inclusion. This issue affects Fitrush: from n/a through 1.3.4...
CVE-2025-49242
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through = 1.4.3...
CVE-2025-49439
Cross-Site Request Forgery CSRF vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects Atelier Create CV: from n/a through = 1.1.5...
CVE-2025-29008
Server-Side Request Forgery SSRF vulnerability in ShawonPro SocialMark socialmark allows Server Side Request Forgery.This issue affects SocialMark: from n/a through = 2.0.7...
CVE-2023-26003
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vipul Jariwala WP Post Corrector allows SQL Injection. This issue affects WP Post Corrector: from n/a through 1.0.2...
CVE-2025-30927 WordPress Wordapp plugin <= 1.7.0 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordapp: from n/a through = 1.7.0...
CVE-2025-30968 WordPress Advanced Post List plugin <= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in jokerbr313 Advanced Post List advanced-post-list allows Cross Site Request Forgery.This issue affects Advanced Post List: from n/a through = 0.5.6.2...
CVE-2025-49315
CVE-2025-49315 affects Persian Woocommerce SMS (Persian Script plugin) and is an SQL Injection due to improper neutralization of inputs in SQL commands. Affected versions range up to 7.0.10; exploitation would involve untrusted input influencing a SQL query. The Wordfence vulnerability listing in...
DEBIAN-CVE-2025-5683
When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1...
CVE-2025-5455
An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value such as...
PT-2025-23493 · Arm · Valhall Gpu Kernel Driver +1
Name of the Vulnerable Software and Affected Versions: Valhall GPU Kernel Driver versions r53p0 through r53p0 Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r53p0 Description: The issue allows a local non-privileged user process to perform improper GPU memory processing...
CVE-2025-1763 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...
GHSA-4MMR-2W8P-WHCR Mattermost improperly allows team administrators to modify team invites
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the...
CVE-2025-5334
CVE-2025-5334 affects Devolutions Remote Desktop Manager across Windows, macOS, Android, and iOS. The issue is a private information exposure in the user vaults component where, under certain conditions, entries edited by their owners can be moved from user vaults to shared vaults, making private...
SUSE CVE-2025-32802
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions...
CVE-2025-32803
In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8...
CVE-2024-38341
IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...