CVE-2025-12652

CVE-2025-12652 — Ungapped Widgets (WordPress) is a stored XSS vulnerability in the ungapped-form shortcode, exploitable via the prefillvalues parameter. Reports indicate exploitation requires authenticated access at contributor level or higher, with the attacker able to inject scripts that run fo...

CVE-2025-11873 WP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2025-11874

CVE-2025-11874 : The WordPress plugin Slippy Slider – Responsive Touch Navigation Slider is vulnerable to Stored Cross-Site Scripting via the shortcode slippy-slider in all versions

CVE-2025-11873

CVE-2025-11873 : WordPress WP BBCode plugin

CVE-2025-11822

The CVE-2025-11822 vulnerability affects the WordPress plugin WP Bootstrap Tabs (versions ≤ 1.0.4). It is a Stored Cross-Site Scripting (XSS) via the bootstrap_tab shortcode caused by insufficient input sanitization and output escaping of user attributes. Impact: authenticated attackers with cont...

CVE-2025-42889 SQL Injection vulnerability in SAP Starter Solution (PL SAFT)

SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application's confidentiality and integrity but no impact on its availability...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

PT-2025-46260

Name of the Vulnerable Software and Affected Versions WP BBCode plugin for WordPress versions up to and including 1.8.1 Description The WP BBCode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'url' shortcode. This is due to inadequate input sanitization and output...

PT-2025-46422

Name of the Vulnerable Software and Affected Versions IntelR QAT Windows software versions prior to 2.6.0 Description An out-of-bounds read issue exists in some IntelR QAT Windows software. A system software adversary with an authenticated user and a high complexity attack may be able to cause a...

PT-2025-46433

Name of the Vulnerable Software and Affected Versions Intel QuickAssist Technology versions prior to 2.6.0 Description A flaw exists in Intel QuickAssist Technology that, due to improper input validation within Ring 3 User Applications, could allow an attacker to escalate privileges. A system...

WordPress Precise Columns plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Precise Columns versions = 1.0...

WordPress WP Count Down Timer plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin WP Count Down Timer versions = 1.0.1...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-64519

TorrentPier (PHP) up to version 2.8.8 is affected by an authenticated SQL injection in the moderator control panel (modcp.php) via the topic_id parameter. The root cause is unsafely embedding the $topic_id input into an SQL query, enabling an authenticated moderator to execute arbitrary SQL with ...

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

Summary An authenticated SQL injection vulnerability exists in the moderator control panel modcp.php. Users with moderator permissions can exploit this vulnerability by supplying a malicious topicid t parameter. This allows an authenticated moderator to execute arbitrary SQL queries, leading to t...

GHSA-4RWR-8C3M-55F6 TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

Summary An authenticated SQL injection vulnerability exists in the moderator control panel modcp.php. Users with moderator permissions can exploit this vulnerability by supplying a malicious topicid t parameter. This allows an authenticated moderator to execute arbitrary SQL queries, leading to t...

CVE-2025-63709

A Cross-Site Scripting XSS vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of a...

CVE-2025-12864

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-12865

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...