CVE-2025-6692

Summary of CVE-2025-6692 (YouTube Embed – WordPress) The vulnerability affects the YouTube Embed plugin for WordPress (versions up to and including 10.3). It is a Stored Cross-Site Scripting (Stored XSS) flaw in the handling of the “instance” parameter, caused by insufficient input sanitization a...

PT-2025-31360 · Elastic +1 · Beats

Name of the Vulnerable Software and Affected Versions: versions prior to 2025 affected versions not specified Description: An uncontrolled search path element vulnerability can lead to local privilege escalation LPE via insecure directory permissions. Improper handling of directory permissions...

CVE-2025-7959

The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2015-10143 Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update

The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajaxsaveoptions function in all versions up to 1.4.4 exclusive. This makes it possible for unauthenticated attackers to update arbitra...

CVE-2025-53472

WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI...

CVE-2025-51867

Insecure Direct Object Reference IDOR vulnerability in Deepfiction AI deepfiction.ai thru June 3, 2025, allowing attackers to chat with the LLM using other users' credits via sensitive information gained by the /browse/stories endpoint...

Siemens SCALANCE LPE9403 Incorrect Permission Assignment For Critical Resource (CVE-2025-40574)

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions. Affected devices do not properly assign permissions to critical ressources. This could allow a non- privileged local attacker to interact with the backupmanager service. This plugin only works with Tenable.ot...

CVE-2025-53472

WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI...

CVE-2025-24936

CVE-2025-24936 refers to a web-application vulnerability where unfiltered user input is passed to a system command, enabling potential remote command execution under the webserver’s context. Documents consistently identify Nokia WaveSuite NOC (and related web-facing components) as affected, with ...

CVE-2025-7919 Simopro Technology｜WinMatrix3 Web package - SQL Injection

WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

PT-2025-30359 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJS versions 11.0.9 and below Description: HAX CMS NodeJS is distributed with hardcoded default credentials for user and superuser accounts and default private keys for JWTs. Users are not prompted to change these credentials or...

CVE-2025-7653

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-27779

CVE-2024-27779 concerns an insufficient session expiration (CWE-613) in Fortinet FortiSandbox and FortiIsolator. Affected: FortiSandbox versions before 4.4.5 (and 4.0–4.2.6) and FortiIsolator versions before 2.4 (and 1.2–2.3). Impact: a remote attacker with a valid admin session cookie can contin...

PT-2025-30000 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions through 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection via the id parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow...

Oracle MySQL Cluster (July 2025 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory. - Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.0-8.0.43,...

EUVD-2025-21785

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and below 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands v...

CVE-2025-53842

Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions. If this vulnerability is exploited, an attacker may tamper with the settings of the device by obtaining the credentials. This vulnerability is caused by an insufficient fix for...

AZL-65474 CVE-2025-50094 affecting package mysql for versions less than 8.0.43-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.42, 8.4.5 and 9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

PT-2025-29603 · Oracle · Oracle Database +1

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 19.3 through 19.27 Oracle Database versions 23.4 through 23.8 Description: This issue affects the Oracle Database component of Oracle Database Server. A low-privileged attacker with Create Session and Create Procedure...

CVE-2025-6423

The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handlesubmituploadfile function in all versions up to, and including, 2.3.5. This makes it possible for authenticated attackers with Subscriber-level access or higher ...