625 matches found
CVE-2025-58633
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through = 1.1.21...
CVE-2025-58606
Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through = 1.3.0...
Linux Distros Unpatched Vulnerability : CVE-2015-4905
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML...
CVE-2025-48364
Server-Side Request Forgery SSRF vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through = 0.4.2...
CVE-2025-48362
Cross-Site Request Forgery CSRF vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affects Hesabfa Accounting: from n/a through = 2.2.5...
CVE-2025-48357
Cross-Site Request Forgery CSRF vulnerability in Theme Century Century ToolKit century-toolkit allows Cross Site Request Forgery.This issue affects Century ToolKit: from n/a through = 1.2.1...
CVE-2025-53337 WordPress LifePress plugin <= 2.1.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n/a through = 2.1.3...
CVE-2025-53250
CVE-2025-53250 corresponds to a Server-Side Request Forgery in the WordPress Chartbeat Plugin (versions n/a–2.0.7). The CVSS 3.1 base metrics indicate a Network attack vector, Low attack complexity, Low privileges required, no user interaction, with Confidentiality and Integrity impacts both Low ...
CVE-2025-48312 WordPress WPAvatar plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 文派翻译（WP Chinese Translation） WPAvatar allows Stored XSS. This issue affects WPAvatar: from n/a through 1.9.3...
CVE-2025-48100
CVE-2025-48100 affects the WordPress plugin bidorbuy Store Integrator (extremeidea bidorbuy Store Integrator). Connected sources describe an improper control of code generation leading to Remote Code Execution (RCE) when versions up to 2.12.0 are installed. The Wordfence listing notes an authenti...
PT-2025-34999
Name of the Vulnerable Software and Affected Versions: wptableeditor Table Editor versions n/a through 1.6.4 Description: A Cross-Site Request Forgery CSRF issue exists in wptableeditor Table Editor, allowing attackers to perform actions on behalf of authenticated users. Recommendations: Update...
PT-2025-35013
Name of the Vulnerable Software and Affected Versions: shmish111 WP Admin Theme versions n/a through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in shmish111 WP Admin Theme, which also allows Stored Cross-Site Scripting XSS. Recommendations: At the moment, there is no...
CVE-2025-58192
Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through = 1.3.6...
CVE-2025-49040
CVE-2025-49040 is a CSRF vulnerability in the WordPress plugin Backup Bolt. Public details indicate it affects versions up to 1.4.1 (initial description), with Patchstack noting vulnerable versions up to 1.5.0. CVSS 3.1 base score 4.3 (Medium) with network attack vector, low attack complexity, no...
Linux Distros Unpatched Vulnerability : CVE-2021-2124
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.18. Easily...
CVE-2025-57805
CVE-2025-57805 affects The Scratch Channel web platform. In versions 1 and 1.1, a POST to the article-publishing endpoint allows posting articles in any category with any date, regardless of login status, indicating an authorization bypass in the publish workflow. The issue has been patched in ve...
Linux Distros Unpatched Vulnerability : CVE-2018-3290
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.20. Easi...
CVE-2025-9131
The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...
Dpanel has an arbitrary file read vulnerability
Summary Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files. Details When a user logs into the administrative backend, this interface can read any files on the host/sever given the...
