PT-2025-21976 · Woocommerce · Pektsekye Year Make Model Search

Name of the Vulnerable Software and Affected Versions: Pektsekye Year Make Model Search for WooCommerce versions 1.0.11 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into...

CVE-2025-47945

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-39491

Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision...

CVE-2025-48024

In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint...

CVE-2024-13940 Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook

The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitra...

IDOR Vulnerability in Template Creation via `projectId` Manipulation

Description An Insecure Direct Object Reference IDOR vulnerability exists in the POST /v1/templates endpoint of the Lunary API. This allows an authenticated user to create templates in another user’s project by modifying the projectId query parameter. This occurs due to a lack of server-side...

CVE-2025-42997 Information Disclosure vulnerability in SAP Gateway Client

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on...

Low: jetty

Issue Overview: For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a...

Amazon Linux 2 : jetty (ALAS-2025-2855)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2855 advisory. For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On...

CVE-2025-47274

CVE-2025-47274 affects ToolHive, a utility for deploying/managing MCP servers. The issue arises from the startup code ordering that causes sensitive data to be written into run configuration files used to restart stopped MCP containers. An attacker with access to the user’s home directory can rea...

Pegasus-Pentest-Arsenal - A Comprehensive Web Application Security Testing Toolkit That Combines 10 Powerful Penetration Testing Features Into One Tool

/\ / | / \ | \ | || | | | | / | /| |/ |/ |/ ,/; ; ; ,'/|; ,/,/, ,'/ |;/,/,/,/| ,/; |;|/,/,/,/,/| ,/'; |;|,/,/,/,/,/| ,/'; |;|/,/,/,/,/,/|, / ; |;|,/,/,/,/,/,/| / ,'; |;|/,/,/,/,/,/,/| /,/'; |;|,/,/,/,/,/,/,/| /;/ '; |;|/,/,/,/,/,/,/,/| ██████╗ ███████╗ ██████╗ █████╗ ███████╗██╗ ██╗███████╗...

PT-2025-20551

Name of the Vulnerable Software and Affected Versions Kong Insomnia Desktop Application versions prior to 11.0.2 Description The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string...

Security Steerability Is All You Need

The adoption of Generative AI GenAI in various applications inevitably comes with expanding the attack surface, combining new security threats along with the traditional ones. Consequently, numerous research and industrial initiatives aim to mitigate these security threats in GenAI by developing...

CVE-2025-37818

creationtimestamp| type| source ---|---|--- 2025-05-08 07:23:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15491 2025-05-08 08:31:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loniqqtvxp2h 2025-05-08 11:45:01+00:00| seen|...

CVE-2025-37819

creationtimestamp| type| source ---|---|--- 2025-05-08 07:23:15+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15490 2025-05-08 08:31:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loniqqxfmz2r 2025-05-08 11:45:06+00:00| published-proof-of-concept|...

A Bootiful Podcast: V Körbes on security from the platform on up

Hi, Spring fans! In today's extra special installment I talk to Broadcom's V Körbes who works on security above and below the application...

CVE-2025-47667

creationtimestamp| type| source ---|---|--- 2025-05-07 18:22:47+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15364 2025-05-07 18:27:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lolzkeeo3222 2025-05-07 19:00:54+00:00| seen| https://t.me/cvedetector/24729...

CVE-2025-47635 WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through = 1.33.28...

CVE-2025-3766

creationtimestamp| type| source ---|---|--- 2025-05-07 05:21:49+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15269 2025-05-07 08:26:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokxyklrhm2w 2025-05-07 08:53:11+00:00| seen|...

Radware Cloud Web Application Firewall Vulnerable to Filter Bypass

Overview The Radware Cloud Web Application Firewall is vulnerable to filter bypass by multiple means. The first is via specially crafted HTTP request and the second being insufficient validation of user-supplied input when processing a special character. An attacker with knowledge of these...