39550 matches found
EUVD-2025-35904
The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input sanitization and output escaping when the "Save source URL" option is enabled. This makes it possible for unauthenticated...
WordPress Password Protected plugin <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing vulnerability
Unauthenticated Authorization Bypass via IP Address Spoofing vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Password Protected versions = 2.7.11...
WordPress plugin Real Cookie Banner 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...
CVE-2025-11244: Improper Authorization
The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers such as X-Forwarded-For, HTTPCLIENTIP, and similar headers to determine user IP...
PT-2025-43703
Name of the Vulnerable Software and Affected Versions Watu Quiz plugin for WordPress versions prior to 3.4.5 Description The Watu Quiz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the HTTP Referer header. This occurs because of inadequate input sanitization and outpu...
WSO2 API Manager 安全漏洞
WSO2 API Manager is a suite of API lifecycle management solutions from US-based WSO2. A security vulnerability exists in WSO2 API Manager that stems from the Try-It feature not properly validating user-supplied URLs, which could lead to server-side request forgery and reflective cross-site...
CVE-2025-60564
creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:02+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228081612773...
CVE-2025-36361
creationtimestamp| type| source ---|---|--- 2025-10-24 13:06:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3wwvcpmv72f...
CVE-2025-10701
creationtimestamp| type| source ---|---|--- 2025-10-24 09:24:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3wkisipz22m...
EUVD-2025-35803
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks...
EUVD-2025-35740
A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the...
Tenda AC6 addressNat function stack buffer overflow vulnerability
Tenda AC6 is a dual-band wireless router from Tenda, designed for 100 Gigabit fiber optic home users. The Tenda AC6 suffers from a stack buffer overflow vulnerability, which originates from the page parameter in the addressNat function failing to properly validate the length of the input data,...
PT-2025-43612
Name of the Vulnerable Software and Affected Versions Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress versions prior to 2.1.5 Description The software contains a Server-Side Request Forgery issue resulting from inadequate...
CVE-2025-61934 AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327
A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the...
maven-model:Xpp3ReaderFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.FilePathTraversal.detectAndGuidePathTrav
Project: https://github.com/apache/maven.git Detailed Report: https://oss-fuzz.com/testcase?key=4556528729522176 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash...
Slack Nebula may accept arbitrary source IP addresses
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
CVE-2025-62820
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
AutomationDirect Productivity Suite 安全漏洞
AutomationDirect Productivity Suite is a programmable logic controller programming software from AutomationDirect, Inc. A security vulnerability exists in AutomationDirect Productivity Suite version v4.4.1.19, which originates from a binding to an unrestricted IP address and could allow an...
CVE-2025-62236: Observable Response Discrepancy
The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attacks...
