BIT-DRUPAL-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

PT-2025-18358 · WordPress · Projectopia

Name of the Vulnerable Software and Affected Versions: The Projectopia – WordPress Project Management plugin for WordPress versions up to, and including, 5.1.16 Description: The issue allows unauthorized modification of data, potentially leading to a denial of service. This is due to a missing...

CVE-2025-46557 Any user with view access to the XWiki space can change the authenticator

XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space by default, anyone can access the page XWiki.Authentication.Administrati...

CVE-2025-32972 The lesscss script service allows cache clearing without programming right

XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, makin...

CVE-2025-3394

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0...

PT-2025-18117 · Unknown · Goanywhere

Name of the Vulnerable Software and Affected Versions: GoAnywhere versions prior to 7.8.0 Description: The issue occurs when a web user without create permission on subfolders attempts to upload a file to a non-existent directory. In this scenario, the error message includes the absolute server...

CVE-2025-46482

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MyThemeShop WP Quiz wp-quiz allows Stored XSS.This issue affects WP Quiz: from n/a through = 2.0.10...

CVE-2025-46445

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through = 0.0.1...

CVE-2025-3904

Vulnerability in Drupal Sportsleague.This issue affects Sportsleague:...

CVE-2025-39602

Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through = 3.9.5...

CVE-2025-39472

Cross-Site Request Forgery CSRF vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through 2.8.3...

CVE-2025-24624

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DevItems HT Event ht-event allows Reflected XSS.This issue affects HT Event: from n/a through = 1.4.6...

CVE-2025-39415

Cross-Site Request Forgery CSRF vulnerability in Jayesh Parejiya Social Media Links social-media-links allows Stored XSS.This issue affects Social Media Links: from n/a through = 1.0.3...

CVE-2025-39586

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through = 5.9.4.8...

CVE-2025-39416

Cross-Site Request Forgery CSRF vulnerability in Ichi translit it! translit-it allows Stored XSS.This issue affects translit it!: from n/a through = 1.6...

CVE-2025-46524

Cross-Site Request Forgery CSRF vulnerability in stesvis WP Filter Post Category wp-filter-post-categories allows Stored XSS.This issue affects WP Filter Post Category: from n/a through = 2.1.4...

CVE-2025-46462

Cross-Site Request Forgery CSRF vulnerability in Trân Minh-Quân WPVN wpvn-username-changer allows Cross Site Request Forgery.This issue affects WPVN: from n/a through = 0.7.8...

CVE-2025-46524

CVE-2025-46524 concerns the WP Filter Post Category WordPress plugin (stesvis) with a CSRF vulnerability that enables Stored XSS in versions up to and including 2.1.4. The issue stems from CSRF handling in the plugin that allows an attacker to induce stored script execution when a trusted user vi...

CVE-2025-39377

CVE-2025-39377 – WordPress Appsero Helper plugin

CVE-2024-12244

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1...