CVE-2025-49386 WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through = 4.0.1...

PT-2025-45404

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 2.9.21 Description The Gravity Forms plugin for WordPress contains a flaw that allows unauthenticated attackers to upload arbitrary files to the server. This issue is caused by missing file type validation withi...

AZL-69857 CVE-2025-46705 affecting package lasso 2.8.0-1

A denial of service vulnerability exists in the gassertnotreached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...

WordPress LMB^Box Smileys plugin <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin LMB^Box Smileys versions = 3.2...

@react-native-community/cli (18.0.0) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (18.0.0)

@react-native-community/cli-server-api NPM version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @react-native-community/cli 18.0.0 Source cves: CVE-2025-11953 Source advisory:...

@react-native-community/cli (>=19.0.0-alpha.0, <=19.1.1) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=19.0.0, <=19.1.1)

@react-native-community/cli-server-api NPM version =19.0.0, =19.0.0-alpha.0, =19.1.1 Source cves: CVE-2025-11953 Source advisory: OSV:GHSA-399J-VXMF-HJVR...

@fluentui-react-native/tester (>=0.170.52, <=0.170.54), @fluentui-react-native/tester-win32-81 (>=0.38.69, <=0.38.70) +3 more potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (17.0.0)

@react-native-community/cli-server-api NPM version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @fluentui-react-native/tester =0.170.52, =0.38.69, =0.81.4, =0.81.5, =0.81.32 Source...

Exploit for Server-Side Request Forgery in Rocket.Chat

CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server...

PT-2025-44591

Name of the Vulnerable Software and Affected Versions OOPSpam Anti-Spam plugin for WordPress versions through 1.2.53 Description The OOPSpam Anti-Spam plugin for WordPress is susceptible to IP Header Spoofing. The plugin improperly trusts client-controlled forwarded headers, such as...

CVE-2025-64096 CryptoLib vulnerable to Stack Buffer Overflow in Crypto_Key_Update due to missing TLV length check

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. Prior to 1.4.2, there is a missing bounds check in CryptoKeyupdate...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +407 more potentially affected by CVE-2025-58179 +1 more via @astrojs/internal-helpers (>=0.0.0-markdoc-config-changes-20230626153541, <=0.7.2)

@astrojs/internal-helpers NPM version =0.0.0-markdoc-config-changes-20230626153541, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.17, =0.0.2, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.0-ast-20240419160649, =0.0.0-10745-20240410180016, =6.2.0, =6.3.6 and more Source cves:...

Laravel File Manager 安全漏洞

Laravel File Manager is a Laravel file manager by Aleksandr Manekin Personal Developer. A security vulnerability exists in Laravel File Manager 3.3.1 and earlier versions, which stems from a flaw in the file upload functionality that could lead to remote code execution...

EUVD-2025-36163

A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-62949

CVE-2025-62949 relates to a Cross-Site Scripting (XSS) vulnerability in the WordPress/BuddyPress plugin chain: Activity Plus Reloaded for BuddyPress (bp-activity-plus-reloaded) with versions up to and including 1.1.2. The issue is described as an improper neutralization of input during web page g...

CVE-2025-62943 WordPress Next Page, Not Next Post plugin <= 0.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt McInvale Next Page, Not Next Post next-page-not-next-post allows Stored XSS.This issue affects Next Page, Not Next Post: from n/a through = 0.3.0...

CVE-2025-62887

The CVE-2025-62887 entry describes a DOM-Based XSS in WordPress Word Addons for Elementor (King Addons for Elementor). Affected product/component: King Addons for Elementor plugin for WordPress, version up to and including 51.1.37. Root cause: Improper Neutralization of Input During Web Page Gene...

PT-2025-43898

Name of the Vulnerable Software and Affected Versions CodeAstro Gym Management System version 1.0 Description A SQL injection issue exists in CodeAstro Gym Management System 1.0. The issue is located in an unknown functionality of the file /admin/actions/check-attendance.php. Manipulation of the ...

WordPress Testimonial Carousel For Elementor plugin <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Testimonial Carousel For Elementor versions = 11.6.2...

Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update CPU. It is, therefore, affected by: - Vulnerability in Oracle Essbase component: Security and Provisioning Bouncy Castle Java Library. The supported version that is...

NewStart CGSL MAIN 7.02 : python-setuptools Vulnerability (NS-SA-2025-0253)

The remote NewStart CGSL host, running version MAIN 7.02, has python-setuptools packages installed that are affected by a vulnerability: - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex ...