WordPress plugin Zoho Flow 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-59691

PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked. In th...

CVE-2025-2404

CVE-2025-2404 : XSS in Ubit Information Technologies’ STOYS student information system. Affected versions: STOYS 2 through 20250916. Root cause: improper neutralization of input during web page generation. Impact: potential cross-site scripting exposure; no exploitation details or in-the-wild dat...

Ubit STOYS 跨站脚本漏洞

Ubit STOYS is a student information system from Ubit Turkey. A cross-site scripting vulnerability exists in Ubit STOYS versions 2 through 20250916, which stems from improper input neutralization during web page generation and could lead to cross-site scripting attacks...

PT-2025-37103

Name of the Vulnerable Software and Affected Versions: 299ko versions up to 2.0.0 Description: A weakness exists in 299ko due to path traversal in the getSentDir/delete function of the plugin/filemanager/controllers/FileManagerAPIController.php file. This issue is remotely exploitable, and the...

PT-2025-37017

Name of the Vulnerable Software and Affected Versions: Testimonial plugin for WordPress versions prior to 2.3 Description: The Testimonial plugin for WordPress is susceptible to SQL Injection via the iNICtestimonial shortcode. This is due to insufficient escaping on the user-supplied parameter an...

WordPress Maspik plugin <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export vulnerability

Authenticated Subscriber+ Missing Authorization to Spam Log Export vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Maspik – Spam blacklist versions = 2.5.6...

PT-2025-36568

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0 Description: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The real pms image proxy endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read...

i-Educar 授权问题漏洞

i-Educar is a free educational software from Portábilis Open Source. An authorization issue vulnerability exists in i-Educar versions 2.10 and earlier, which stems from an improper authorization issue in the /module/Api/turma file...

PT-2025-36437

Name of the Vulnerable Software and Affected Versions: elunez eladmin versions up to 2.7 Description: A vulnerability exists in elunez eladmin that affects the queryErrorLogDetail function within the SysLogController component. The vulnerability is located in the file /api/logs/error/1 and leads ...

PT-2025-36164

Name of the Vulnerable Software and Affected Versions: Habibur Rahman Comment Form WP – Customize Default Comment Form versions through 2.0.0 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for...

i-Educar 安全漏洞

i-Educar is a free educational software from Portábilis Open Source. A security vulnerability exists in i-Educar version 2.10 and earlier, which stems from a SQL injection due to the incorrect operation of the parameter refcodaluno in the file educarhistoricoescolarlst.php...

WordPress Single Property theme <= 2.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Single Property versions = 2.8...

WordPress Greeny theme <= 2.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Greeny versions = 2.6...

Linux Distros Unpatched Vulnerability : CVE-2021-40401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev commit b5f1eacd and Gerbv forked 2.7....

ruoyi-go 路径遍历漏洞

ruoyi-go is a backend management system for individual developers at lostvip.com. A path traversal vulnerability exists in ruoyi-go 2.1 and earlier versions, which stems from the improper handling of the fileName parameter in the DownloadTmp/DownloadUpload function in the file...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Portabilis i‑Diário 安全漏洞

Portabilis i-Diário is an open source school academic calendar and teacher interaction management system from Portabilis, Brazil. A security vulnerability exists in Portabilis i-Diário version 2.10 and earlier, which stems from a SQL injection attack due to incorrect manipulation of the parameter...

WordPress Birth Chart Compatibility 2.0 Path Disclosure

WordPress Birth Chart Compatibility plugin versions 2.0 and below suffer from a path disclosure vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2025-21605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited...