CVE-2025-59581 WordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through = 1.2.5.3...

CVE-2025-59581

CVE-2025-59581 - Ibtana (WordPress Website Builder) Missing Authorization vulnerability present in Ibtana, allowing Arbitrary Content Deletion due to improper access control. Affected versions: up to 1.2.5.3 (from n/a to 1.2.5.3). Connected docs corroborate the issue as an access-control weakness...

CVE-2025-55173

A vulnerability in Next.js Image Optimization allowed attacker-controlled image servers to trigger arbitrary file downloads with custom content and filenames. Exploitation required permissive images.domains or images.remotePatterns and user interaction. Binary-Affected: Next.js...

CVE-2025-55173

CVE-2025-55173 is a vulnerability in Next.js Image Optimization: attacker-controlled external image sources could cause content injection, enabling file downloads with arbitrary content/filenames under certain configurations and potentially aiding phishing. Affected versions are Next.js before 14...

GHSA-XV57-4MR9-WG8V Next.js Content Injection Vulnerability for Image Optimization

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious...

WordPress Javo Core plugin <= 3.0.0.529 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Bonds in WordPress Plugin Javo Core versions = 3.0.0.529...

CVE-2025-55746

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

CVE-2025-55746

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

CVE-2025-55746

Directus vulnerability (CVE-2025-55746) affects Directus real-time API/dashboard. From 10.8.0 to before 11.9.3, an issue in the file update mechanism lets an unauthenticated actor modify existing files with arbitrary content and/or upload new files (with arbitrary extensions) without updating dat...

CVE-2025-54679 WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Neon Channel Product Customizer Free: from n/a through = 2.0...

CVE-2025-54679 WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Neon Channel Product Customizer Free: from n/a through 2.0...

CVE-2025-31425 WordPress WP Lead Capturing Pages plugin < 2.6 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through 2.6...

CVE-2025-31425 WordPress WP Lead Capturing Pages plugin < 2.6 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through 2.6...

CVE-2025-50029 WordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in Ashish AI Tools allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI Tools: from n/a through 4.0.7...

CVE-2025-50029 WordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in Ashish AI Tools artificial-intelligence-auto-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Tools: from n/a through = 4.0.7...

WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by theviper17 in WordPress Plugin Neon Channel Product Customizer Free versions = 2.0...

WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin WordPress Event Manager, Event Calendar and Booking Plugin versions = 4.0.24...

WordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by theviper17 in WordPress Plugin AI Tools versions = 4.0.7...

TabberNeue 安全漏洞

TabberNeue is an extension to StarCitizen.tools open source. Allows the Wiki to create tabs in pages. A security vulnerability exists in versions prior to TabberNeue 3.1.1 that stems from allowing users to insert arbitrary HTML into the DOM via the tabber tag attribute...

CVE-2025-6087

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...