CVE-2025-6388

The CVE-2025-6388 issue affects the Spirit Framework WordPress plugin up to version 1.2.14, where the custom_actions() function does not properly validate a user’s identity before authentication, enabling unauthenticated login as any user (including admins) when the attacker knows a username. Thi...

WordPress plugin Spirit Framework has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-40572

Name of the Vulnerable Software and Affected Versions HCL MyXalytics affected versions not specified Description The HCL MyXalytics web application is susceptible to a Cross Site Scripting issue. This allows the execution of unauthorized scripts, which could lead to unauthorized actions or access...

PT-2025-40540

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0-nightly-2025-10-03 and below Description phpMyFAQ does not enforce uniqueness of email addresses during user registration, allowing multiple distinct accounts to be created with the same email. This can cause account...

ProjectSend < r1720 Improper Authorization

ProjectSend version prior to r1720 is affected by an Improper Authorization vulnerability. An unauthenticated attacker can exploit this issue to access sensitive information and perform unauthorized actions within the application. No source data...

PT-2025-40472

Name of the Vulnerable Software and Affected Versions PayPal Forms plugin for WordPress versions up to and including 1.0.3 Description The PayPal Forms plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation during form creation and...

CVE-2025-52653: Improper Neutralization of Input During Web Page Generation

HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the API. An attacker can perform unauthorized actions, such as creating and starting arbitrary instances or executing arbitrary commands inside containers, by tricking a victim authenticated with clien...

CVE-2025-61584

serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the...

CVE-2025-41010 Cross-origin resource sharing (CORS) in Hiberus Sintra

Incorrect Cross-Origin Resource Sharing CORS configuration in Hiberus Sintra. Cross-Origin Resource Sharing CORS allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol...

CVE-2025-41010: Permissive Cross-domain Policy with Untrusted Domains

Incorrect Cross-Origin Resource Sharing CORS configuration in Hiberus Sintra. Cross-Origin Resource Sharing CORS allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol...

A Cybersecurity AI Agent Selection and Decision Support Framework

This paper presents a novel, structured decision support framework that systematically aligns diverse artificial intelligence AI agent architectures, reactive, cognitive, hybrid, and learning, with the comprehensive National Institute of Standards and Technology NIST Cybersecurity Framework CSF...

PT-2025-40345

Name of the Vulnerable Software and Affected Versions Hiberus Sintra affected versions not specified Description An incorrect Cross-Origin Resource Sharing CORS configuration exists in Hiberus Sintra. CORS allows browsers to make cross-domain requests in a controlled manner, using the “Origin”...

VulnCheck KEV: CVE-2025-6388

The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the customactions function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated...

Fiora chat group avatar is vulnerable to XSS via SVG files

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-23292

NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service UI component...

CVE-2023-50300

IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls...

CVE-2023-50300 IBM Transformation Extender Advanced improper access control

IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls...

Security Bulletin: IBM Transformation Extender Advanced could allow a local user to perform unauthorized actions due to improper access controls.

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, could allow a local user to perform unauthorized actions due to improper access controls. Vulnerability Details CVEID:CVE-2023-50300 DESCRIPTION: IBM Standards Processing Engine could allow a local user t...

CVE-2025-56392

An Insecure Direct Object Reference IDOR in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perform arbitrary operations via a crafted POST request...