CVE-2025-32152

CVE-2025-32152 concerns Slider a SlidersPack – Image Slider, Post Slider, ACF Gallery Slider (WordPress) with an authenticated (Contributor+) Local File Inclusion due to Improper Control of Filename for Include/Require in PHP. Affected versions: Slider a SlidersPack up to 2.3. The entry notes PHP...

WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phat RiO - Fore-Z co.ltd in WordPress Plugin uListing versions = 2.2.0...

Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware

Microsoft is warning of several phishing campaigns that are leveraging tax-related themes to deploy malware and steal credentials. "These campaigns notably use redirection methods such as URL shorteners and QR codes contained in malicious attachments and abuse legitimate services like file-hostin...

PT-2025-14703 · Unknown · Notfound Include-File

Name of the Vulnerable Software and Affected Versions: NotFound include-file versions n/a through 1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, in the NotFound include-file. This vulnerability...

CVE-2025-31103

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server...

This Week in Sprng - April 1st, 2025

Hi, Spring fans! Welcome to another exciting installment of This Week in Spring! It's April Fools day, so be wary of things you read on the internet, but it's also the 11th anniversary of Spring Boot 1.0, which was released this day in 2014! that's not an April Fools. Happy birthday! I'm in...

PT-2025-14154 · Unknown · Post Custom Templates Lite

Name of the Vulnerable Software and Affected Versions: Post Custom Templates Lite versions n/a through 1.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker ca...

PT-2025-14043

Name of the Vulnerable Software and Affected Versions Ays Pro Quiz Maker versions n/a through 6.6.8.7 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendation...

ASB-A-393950964

Bulletin has no description...

ASB-A-388047866

Bulletin has no description...

ASB-A-388047607

Bulletin has no description...

PT-2025-14193 · Xtreme · Planyo

Name of the Vulnerable Software and Affected Versions: xtreeme Planyo online reservation system versions n/a through 3.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that a...

ASB-A-393950961

Bulletin has no description...

ASB-A-380302155

Bulletin has no description...

ASB-A-382770071

Bulletin has no description...

CVE-2025-31406

Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through = 2.3.9...

CVE-2025-31406 WordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through = 2.3.9...

WordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Thaleikis in WordPress Plugin ELEX WooCommerce Request a Quote versions = 2.3.9...

CVE-2025-31103

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server...

CVE-2025-31103

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server...