CVE-2025-27617

Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue...

CVE-2025-27617 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue...

CVE-2025-27493

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrat...

Exploit for Missing Authorization in Directsoftware Order_Attachments_For_Woocommerce

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756...

CVE-2025-26656

CVE-2025-26656 affects SAP S/4HANA via the OData service in Manage Purchasing Info Records. The root cause is missing authorization checks for an authenticated user, enabling privilege escalation with a low integrity impact. CVSS 3.1 vector shows low privileges required and low impact. No exploit...

Zoom Workplace 资源管理错误漏洞

Zoom Workplace is an AI-first collaboration platform from Zoom that integrates core features such as team communication, meetings, document collaboration, and a built-in AI Companion smart assistant to boost productivity. A post-release reuse vulnerability exists in Zoom Workplace. The...

SAP Just In Time 安全漏洞

SAP Just In Time is an application from SAP Germany designed to enable efficient demand-driven production and logistics throughout the supply chain. An elevation of privilege vulnerability exists in SAP Just In Time, which stems from the OData service not performing the necessary privilege checks...

CVE-2024-13675

The CVE-2024-13675 entry maps to the SlingBlocks – Gutenberg Blocks by FunnelKit plugin for WordPress. Affected: SlingBlocks versions up to and including 1.5.0. Issue: Stored Cross-Site Scripting via the Icon List Block due to insufficient input sanitization and output escaping. Impact: Authentic...

CVE-2025-1324

CVE-2025-1324 affects the WordPress plugin WP-Recall – Registration, Profile, Commerce & More. It describes a Stored Cross-Site Scripting via the plugin’s shortcode public-form in all versions up to 16.26.10, caused by insufficient input sanitization and output escaping on user-provided attribute...

CVE-2024-13816

The CVE-2024-13816 entry covers Aiomatic – Automatic AI Content Writer & Editor (WordPress plugin) with vulnerable versions up to 2.3.6, where missing capability checks allow authenticated users with Subscriber-level access and above to perform multiple administrator actions (update/delete posts,...

CVE-2024-12119 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the defaultgallerytitlesize parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escapin...

WordPress Gallery Styles plugin <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Gallery Styles versions = 1.3.4...

WordPress FooGallery plugin <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates vulnerability

Insecure Direct Object Reference to Authenticated Custom+ Arbitrary Post/Page Updates vulnerability discovered by Stiofan in WordPress Plugin FooGallery versions = 2.4.29...

CVE-2024-13890

CVE-2024-13890 affects the WordPress plugin Allow PHP Execute (

CVE-2025-1768

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2024-12609

The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in th...

CVE-2025-0959 Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id

The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the regid parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-0863 Flexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idxframe' shortcode in all versions up to, and including, 3.14.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13809 Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection

The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

WordPress Lafka theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import vulnerability

Missing Authorization to Authenticated Subscriber+ Demo Import vulnerability discovered by Lucio Sá in WordPress Theme Lafka versions = 4.5.7...