PT-2025-34458 · Reolink · Reolink Smart 2K+ Plug-In Wi-Fi Video Doorbell With Chime

Name of the Vulnerable Software and Affected Versions: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.4662 2503122283 Description: The device suffers from insufficient privilege verification. Authenticated attackers can create accounts with elevated privileges...

CVE-2025-55103

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in th...

Cross-site Scripting (XSS)

Overview com.liferay:com.liferay.layout.admin.web is a portal for Liferay. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the type parameter. An authenticated attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious...

CVE-2025-8064 Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter

The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selectorheight’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-8064

The CVE describes a Stored Cross-Site Scripting vulnerability in the Bible SuperSearch WordPress plugin (

PT-2025-34253 · Akaunting · Akaunting

Name of the Vulnerable Software and Affected Versions: Akaunting version 3.1.18 Description: An issue in the /settings/localisation component allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request. Recommendations: At the moment, there is no information about a...

CVE-2025-50860

Easy Hosting Control Panel (EHCP) version 20.04.1.b is vulnerable to a SQL Injection in the listdomains function. The root cause is the insufficient validation of the arananalan POST parameter within the /index.php?op=listdomains endpoint. An authenticated attacker can leverage error-based, time-...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2025-34190 · WordPress +1 · Slingblocks – Gutenberg Blocks By Funnelkit +1

Name of the Vulnerable Software and Affected Versions: SlingBlocks – Gutenberg Blocks by FunnelKit Formerly WooFunnels versions prior to 1.6.1 Description: The SlingBlocks – Gutenberg Blocks by FunnelKit Formerly WooFunnels plugin for WordPress is susceptible to Stored Cross-Site Scripting throug...

CVE-2025-55521

A security vulnerability exists in the Akaunting application, specifically within version v3.1.18 . The issue is located in the /settings/localisation component, where authenticated attackers can trigger a Denial of Service (DoS) by sending a crafted POST request . No information regarding a patc...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-47184

An XML external entities XXE injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escalation via a crafted ISys XML message...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-6181

The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation...

CVE-2025-6181

The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation...

CVE-2025-6181

The CVE-2025-6181 affects the StrongDM Windows service, where input validation is incorrectly handled. The root cause is input validation failures that could allow an authenticated local attacker to escalate privileges. The CVSSv4 vector indicates a HIGH-severity, local attack with low complexity...

CVE-2025-1142

Summary: CVE-2025-1142 affects IBM Edge Application Manager 4.5. The Red Hat, NVD, and IBM bulletin entries corroborate a server-side request forgery (SSRF) vulnerability in IBM Edge Application Manager 4.5, enabling an authenticated attacker to issue unauthorized requests from the vulnerable sys...

CVE-2025-54927

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system...

CVE-2025-54927

CVE-2025-54927 concerns Schneider Electric EcoStruxure Power Monitoring Expert. The issue is a directory traversal via the HttpPostedFile module that could enable remote code execution. Exploitation requires authentication and is demonstrated in public advisories (e.g., ZDI-25-828) with attacker-...

PT-2025-34124 · Strongdm · Strongdm

Name of the Vulnerable Software and Affected Versions: StrongDM versions affected versions not specified Description: The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this issue, leading to privilege escalation. Recommendations: ...