15013 matches found
CVE-2025-2594
The CVE-2025-2594 affects the WordPress plugin “User Registration & Membership” prior to version 4.1.3. Affected behavior: when the Membership Addon is enabled, data in an AJAX action is not properly validated, enabling an attacker to authenticate as any user (including administrators) by supplyi...
Moodle 跨站请求伪造漏洞
Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site request forgery vulnerability that stems from the lack of an anti-cross-site request forgery...
PT-2025-17488 · WordPress · User Registration & Membership
Name of the Vulnerable Software and Affected Versions: User Registration & Membership WordPress plugin version 4.1.2 and earlier Description: The issue concerns the User Registration & Membership WordPress plugin, where data in an AJAX action is not properly validated when the Membership Addon is...
MAL-2025-3269 Malicious code in vault-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c39e1eed1d8bf3442c38c8963d7e9aae31825a734eec63405aa146da7a02b57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vault-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c39e1eed1d8bf3442c38c8963d7e9aae31825a734eec63405aa146da7a02b57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Scoring Azure Permissions with Metric Spaces
In this work, we introduce two complementary metrics for quantifying and scoring privilege risk in Microsoft Azure. In the Control Plane, we define the WAR distance, a superincreasing distance over Write, Action, and Read control permissions, which yields a total ordering of principals by their...
PT-2025-17349 · WordPress +1 · Order Delivery Date +1
Name of the Vulnerable Software and Affected Versions: Order Delivery Date WordPress plugin versions prior to 12.6.0 Description: The Order Delivery Date WordPress plugin before version 12.6.0 discloses arbitrary post titles including draft and private posts through an unauthenticated AJAX action...
CVE-2025-24619
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webheadcoder WP Log Action wp-log-action allows Reflected XSS.This issue affects WP Log Action: from n/a through = 0.51...
CVE-2025-24619 WordPress WP Log Action Plugin <= 0.51 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webheadcoder WP Log Action wp-log-action allows Reflected XSS.This issue affects WP Log Action: from n/a through = 0.51...
MAL-2025-3240 Malicious code in fatfingers-hahayeet (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab10b9a2ff027ef8bfac4c8953e64c6a24e799afecb082e727da93d58fd0cb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3225 Malicious code in @harvest-finance/harvest-strategy-arbitrum (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062f2e97a3824c2a6e95152cfe109cfeaa5426a6153438aad07eabee03820ba3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress plugin WP Log Action 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2025-17037 · WordPress · Webheadcoder Wp Log Action
Name of the Vulnerable Software and Affected Versions: webheadcoder WP Log Action versions 0.51 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacker...
MAL-2025-3215 Malicious code in @csds-web-components/csds-icon (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dc035502fe2552360c01c2157ffadef0e94f13981a392ac55b634cac666e4d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
📄 phpMyFAQ 3.1.7 Cross Site Scripting
phpMyFAQ version 3.1.7 suffers from a cross site scripting vulnerability. Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting XSS Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/thorsten/phpMyFAQ Software Link: https://github.com/thorsten/phpMyFAQ Versio...
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting XSS Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/thorsten/phpMyFAQ Software Link: https://github.com/thorsten/phpMyFAQ Version: 3.1.7 Tested on: Ubuntu Windows CVE : CVE-2022-4407 PoC: Get:...
CVE-2025-30215 NATS-Server Fails to Authorize Certain Jetstream Admin APIs
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...
CVE-2025-30737
CVE-2025-30737 affects Oracle Smart View for Office (Core Smart View) and is documented for version 24.200. The vulnerability enables a high-privileged attacker, with network access via HTTP, to compromise the product. Exploitation requires user interaction from a person other than the attacker, ...
CVE-2025-30730
The CVE-2025-30730 entry concerns Oracle E-Business Suite’s Oracle Application Object Library (Core), affected in versions 12.2.5–12.2.14. The vulnerability enables an unauthenticated attacker with network access via HTTP to cause a hang or a frequently repeatable crash (complete DoS) of Oracle A...