PT-2025-34515 · WordPress · Ws Theme Addons

Name of the Vulnerable Software and Affected Versions: WS Theme Addons plugin for WordPress versions prior to 2.0.1 Description: The WS Theme Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ws weather shortcode. Insufficient input sanitization and output...

MAL-2025-38959 Malicious code in weather-cli-05-09-2023 (npm)

The package weather-cli-05-09-2023 was found to contain malicious code...

Malicious code in weather-cli-05-09-2023 (npm)

The package weather-cli-05-09-2023 was found to contain malicious code...

Malicious code in ksl-weather (npm)

The package ksl-weather was found to contain malicious code...

MAL-2025-24791 Malicious code in ksl-weather (npm)

The package ksl-weather was found to contain malicious code...

Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Data

The Model Context Protocol MCP represents a significant advancement in AI-tool integration, enabling seamless communication between AI agents and external services. However, this connectivity introduces novel attack vectors that remain largely unexplored. This paper demonstrates how unsophisticat...

CVE-2025-28980

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through = 0.7.2...

CVE-2025-28980

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through = 0.7.2...

CVE-2025-28980

CVE-2025-28980 is a path traversal vulnerability in the WordPress plugin “Aviation Weather from NOAA” (versions

CVE-2025-28980 WordPress Aviation Weather from NOAA <= 0.7.2 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in machouinard Aviation Weather from NOAA allows Path Traversal. This issue affects Aviation Weather from NOAA: from n/a through 0.7.2...

CVE-2025-28980 WordPress Aviation Weather from NOAA plugin <= 0.7.2 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through = 0.7.2...

PT-2025-27904 · Noaa · Aviation Weather

Name of the Vulnerable Software and Affected Versions: Aviation Weather from NOAA versions 0.7.2 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in the affected software...

WordPress plugin Aviation Weather from NOAA 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exis...

CVE-2025-52809

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National Weather Service Alerts: from n/a through ...

CVE-2025-52809

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National Weather Service Alerts: from n/a through ...

CVE-2025-52809 WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National Weather Service Alerts: from n/a through ...

CVE-2025-52809

CVE-2025-52809 describes an unauthenticated Local File Inclusion in the WordPress plugin National Weather Service Alerts (versions ≤ 1.3.5). The vulnerability arises from Improper Control of Filename for Include/Require in a PHP program, enabling local file inclusion via user-controlled input. Pu...

PT-2025-27128 · Unknown · John Russell National Weather Service Alerts

Name of the Vulnerable Software and Affected Versions: John Russell National Weather Service Alerts versions 1.3.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows...

WordPress plugin National Weather Service Alerts 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the Product Delivery Service component of the software for collecting, analyzing, and visualizing meteorological data, Visual Weather, and related products such as NAMIS, Aero Weather, and Satellite Weather, allows a perpetrator to execute arbitrary code or cause service failures.

The vulnerability of the Product Delivery Service component of the software for collecting, analyzing, and visualizing meteorological data Visual Weather and related products such as NAMIS and Aero Weather lies in insufficient validation of input data. Exploiting this vulnerability could allow an...