📄 The Language Sloth Web Application 1.0 Cross Site Scripting

The Language Sloth Web Application version 1.0 suffers from a cross site scripting vulnerability. CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrar...

WordPress WoodMart plugin <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Theme WoodMart versions = 8.2.3...

Bolt CMS vulnerable to authenticated remote code execution

Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend...

CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The nettools.php functionality allows authenticated users to execute arbitrary OS commands via the selectips parameter when performing network tools operations, such as pinging. This occurs becau...

CVE-2025-34076

CVE-2025-34076 is an authenticated local file inclusion in Microweber CMS (versions ≤ 1.2.11) caused by insecure handling of the backup management API. The vulnerable components are the /api/BackupV2/upload and /api/BackupV2/download endpoints, which allow an absolute file path to be supplied via...

CVE-2025-34074

CVE-2025-34074 is an authenticated remote code execution in Lucee’s administrative interface via insecure design of the scheduled task feature. An admin who can access /lucee/admin/web.cfm can configure a scheduled job to fetch a remote .cfm file from a attacker-controlled server, write it to the...

WordPress Home Villas theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Thái An in WordPress Theme Home Villas versions = 2.8...

CVE-2025-34042

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which...

CVE-2025-6689

CVE-2025-6689 : The FL3R Accessibility Suite WordPress plugin suffers a Stored Cross-Site Scripting vulnerability via the fl3raccessibilitysuite shortcode in versions up to 1.4. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing authent...

CVE-2025-34042 Beward N100 IP Camera Remote Command Execution

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which...

CVE-2025-5540 Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

Drupal Klaro Cookie & Consent Management module < 3.0.7 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Klaro Cookie & Consent Management versions 3.0.7...

CVE-2025-41233

Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the Moderate severity range https://www.broadcom.com/support/vmware-services/security-response with a maximum CVSSv3 base score of 6.8...

CVE-2025-6012

CVE-2025-6012 – WordPress Auto Attachments plugin suffers a stored XSS in admin settings for versions up to 1.8.5. The issue arises from insufficient input sanitization and output escaping, enabling authenticated attackers with administrator-level permissions (and above) to inject arbitrary scrip...

CVE-2025-36528 SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports...

CVE-2025-27709

Affected product: Zohocorp ManageEngine ADAudit Plus, versions 8510 and prior. Description: authenticated SQL injection in the Service Account Auditing reports (root cause per sources). Impact: CVSSv3.1 base score 8.3 (HIGH) with confidentiality and integrity impacts; exploitation details not pro...

CVE-2024-25228

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution RCE via the getVerifydiyResult function in ManoeuvreHandler.class.php...

CVE-2024-22899

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the syncNtpTime function...

CVE-2024-46658

Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 was discovered to contain an authenticated command injection vulnerability...

CVE-2024-41136

An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...