WordPress B Slider- Gutenberg Slider Block for WP plugin <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Plugin Installation vulnerability discovered by wesley wcraft in WordPress Plugin B Slider versions = 1.1.30...

EUVD-2025-205664

A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulation of the argument a/b/c/d causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public...

CVE-2025-15209: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulation of the argument a/b/c/d causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS Advisory. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-177-01 Mitsubishi Electric Air Conditioning Systems Update B CISA encourages users and administrators to...

CVE-2025-65837

PublicCMS version V5.202506.b is vulnerable to Cross Site Scripting (XSS) within its Content Search module . The flaw allows for the injection of malicious scripts through the content search functionality due to improper neutralization of input during web page generation. No information regarding...

CVE-2025-65837

PublicCMS V5.202506.b is vulnerable to Cross Site Scripting XSS in the Content Search module...

CVE-2025-63364: Cleartext Transmission of Sensitive Information

Waveshare RS232/485 TO WIFI ETH B Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Administrator credentials in plaintext...

CVE-2025-63363: Improper Access Control

A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH B Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to execute de-authentication attacks, allowing crafted deauthentication and disassociation frames to be broadca...

CVE-2025-63362: Unverified Password Change

Waveshare RS232/485 TO WIFI ETH B Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication...

CVE-2025-63361: Insufficiently Protected Credentials

Waveshare RS232/485 TO WIFI ETH B Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext...

CVE-2025-65838

PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method...

CVE-2025-13797 ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection

A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdelswifimac of the file /sendorder.cgi. Performing manipulation of the argument delswifimac results in command injection. The attack is possible to be carried out remotely. The exploit is...

CVE-2025-13797 ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection

A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdelswifimac of the file /sendorder.cgi. Performing manipulation of the argument delswifimac results in command injection. The attack is possible to be carried out remotely. The exploit is...

CVE-2025-13797

The CVE-2025-13797 issue affects ADSLR B-QE2W401 (version 250814-r037c). The vulnerable component is the function parameter del_swifimac in /send_order.cgi, where manipulation enables remote command injection. Exploitation is publicly available and vendor has not responded. No specific patch/vers...

PT-2025-48547

PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method...

ADSLR B-QE2W401 安全漏洞

The ADSLR B-QE2W401 is a wireless router from China's Flying Fish Star ADSLR. A security vulnerability exists in ADSLR B-QE2W401 version 250814-r037c, which stems from the incorrect operation of the parameter delswifimac in the file /sendorder.cgi, which could lead to command injection...

CVE-2025-13797: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdelswifimac of the file /sendorder.cgi. Performing manipulation of the argument delswifimac results in command injection. The attack is possible to be carried out remotely. The exploit is...

PublicCMS 安全漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS version V5.202506.b, which originates from a cross-site request forgery in CkEditorAdminController...

PT-2025-48400

Name of the Vulnerable Software and Affected Versions ADSLR B-QE2W401 version 250814-r037c Description A command injection issue exists in ADSLR B-QE2W401 250814-r037c. Manipulation of the del swifimac parameter within the /send order.cgi file can lead to command execution. This attack can be...

PublicCMS 安全漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS version V5.202506.b, which originates from a server-side request forgery in the SimpleAiAdminController chat interface...