CVE-2024-9643

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to...

Four-Faith F3x36 安全漏洞

The Four-Faith F3x36 is a portable wireless mobile router from Four-Faith China. A security vulnerability exists in Four-Faith F3x36 version v2.0.0, which stems from the use of hard-coded credentials. An attacker could exploit the vulnerability to gain administrative access via a specially crafte...

PT-2025-2117

Name of the Vulnerable Software and Affected Versions WP Dream Carousel WordPress plugin versions 1.0.1b and earlier Description The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs because a parameter is not sanitised...

CVE-2025-24960

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the routes. This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admins, there is very little scope for abuse. However, the DELETE...

CVE-2025-24960 Missing Input validation for filename in backups endpoint in Jellystat

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the routes. This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admins, there is very little scope for abuse. However, the DELETE...

CVE-2024-12510 LDAP Authentication Sever Pass-back attack

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup...

CVE-2024-12510 LDAP Authentication Sever Pass-back attack

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup...

PT-2025-4747 · Polycom · Polycom Realpresence Group 500

Name of the Vulnerable Software and Affected Versions: Polycom RealPresence Group 500 versions =20 Description: The issue is related to insecure permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting in the leakage of sensitive user...

CVE-2024-13224

The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Survey Maker plugin <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question vulnerability

Authenticated Admin+ Stored Cross-Site Scripting via Survey Question vulnerability discovered by Joel Indra in WordPress Plugin Survey Maker versions = 5.1.3.3...

CVE-2025-22222

VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known...

CVE-2025-0861

CVE-2025-0861 affects the VR-Frases (collect & share quotes) WordPress plugin. The vulnerability is a SQL Injection in multiple parameters for all versions up to and including 3.0.1, caused by insufficient escaping and lack of proper query preparation. Unauthenticated attackers could append addit...

WordPress VR-Frases (collect & share quotes) plugin <= 3.0.1 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by johska in WordPress Plugin VR-Frases versions = 3.0.1...

PT-2025-4068 · Unknown · Needyamin Library Card System

Name of the Vulnerable Software and Affected Versions: needyamin Library Card System version 1.0 Description: A critical issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the email/password argument leads to SQL injection. The attack may be...

CVE-2024-13057

The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-13052

The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12773 Altra Side Menu <= 2.0 - Admin+ SQL Injection

The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

PT-2025-1949

Name of the Vulnerable Software and Affected Versions Altra Side Menu WordPress plugin through 2.0 Description The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in admins delete arbitrary menus via a CSRF attack. This could potentially be...

CVE-2024-13505

The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ayssections5questions8title’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13505 Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question

The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ayssections5questions8title’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...