CVE-2025-11676

Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 UPnP modules, which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 = Build 220801...

EUVD-2025-198390

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gutenberg blocks in all versions up to, and including, 3.0.0 due to insufficient input validation on user-supplied HTML tag names. This is due to the lack of a tag name...

CVE-2025-13134

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2025-12660

The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-11764

The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in the notification shortcode in all versions up to, and including, 1.1. This is due to missing input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-13134 AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

PT-2025-47699

The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

PT-2025-47696

Name of the Vulnerable Software and Affected Versions Tainacan versions prior to 1.0.1 Description The Tainacan plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the search parameter. An unauthenticated...

PT-2025-47691

Name of the Vulnerable Software and Affected Versions WPBookit versions up to and including 1.0.6 Description The WPBookit plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to a missing capability check on the save custome code function, allowing unauthenticated...

WordPress plugin AuthorSure 跨站请求伪造漏洞

WordPress AuthorSure plugin is an open source plugin designed for the WordPress platform, mainly used to manage the submission process of multi-author sites. WordPress AuthorSure plugin has a cross-site request forgery vulnerability, the vulnerability stems from the lack of random number validati...

The vulnerability of the KeeneticOS operating system, related to the failure to handle CRLF sequences properly, allows a hacker to execute arbitrary commands and gain full control over the device.

The vulnerability of the KeeneticOS operating system is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands and gain full control over the device...

The vulnerability of the Equal() function in the crypto-x509 component of the Go programming language allows a perpetrator to trigger a service failure.

The vulnerability of the Equal function in the crypto-x509 component of the Go programming language is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

CVE-2025-64408

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...

CVE-2025-35029

CVE-2025-35029 affects Medical Informatics Engineering Enterprise Health with a stored cross-site scripting vulnerability on the Demographic Information page. An authenticated attacker can inject arbitrary content that is rendered and executed when a victim accesses it. The issue is fixed as of 2...

CVE-2025-62295

SOPlanning is vulnerable to Stored XSS in /groupeform endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

EUVD-2025-198311

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...

EUVD-2025-198299

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2025-36161 IBM Concert Software Information Disclosure

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Path Traversal

github.com/canonical/lxd is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of log file paths, where crafted file names or symlinks allow authenticated remote attackers to traverse directories and read arbitrary files on the host system...

CVE-2025-11676

CVE-2025-11676 affects TP-Link TL-WR940N V6 (UPnP modules). The issue is an improper input validation vulnerability that allows unauthenticated adjacent attackers to cause a denial-of-service, affecting TL-WR940N V6