Discourse 3.6.x < 3.6.0.beta1 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

CVE-2025-59337

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...

CVE-2025-59337 Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...

CVE-2025-59337 Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...

CVE-2025-59337

Summary: CVE-2025-59337 affects Discourse prior to 3.5.1. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore, enabling an admin of one multisite deployment to access data or credentials from other sites. Root cause: backup restorati...

CVE-2025-9993

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

CVE-2025-10744

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view information like full paths and...

CVE-2025-10744

The CVE concerns the WordPress plugin File Manager, Code Editor, and Backup by Managefy (versions up to 1.6.1). Publicly exposed log files allow unauthenticated attackers to view sensitive details, including full file paths and backup file locations. Technical details in connected sources confirm...

CVE-2025-10744 File Manager, Code editor, backup by Managefy <= 1.6.1 - Unauthenticated Information Exposure

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view information like full paths and...

Discourse 命令注入漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A command injection vulnerability exists in Discourse 3.5.0 and prior versions, which stems from a malicious meta-command that can be...

PT-2025-40060

Name of the Vulnerable Software and Affected Versions The File Manager, Code Editor, and Backup by Managefy plugin for WordPress versions prior to 1.6.2 Description The plugin is susceptible to a sensitive information exposure issue due to publicly exposed log files. This allows unauthenticated...

PT-2025-40301

Name of the Vulnerable Software and Affected Versions Discourse versions 3.5.0 and below Description Discourse is a community discussion platform. A flaw exists where malicious meta-commands could be placed within a backup dump and then executed during the restore process. In environments with...

CVE-2025-59337: Improper Neutralization of Special Elements used in a Command

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...

CVE-2025-9993

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

Arbitrary Code Injection

Craft CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to inadequate protection of restore functionality because, with a compromised security key and the ability to place an arbitrary file in storage/backups, an attacker can craft a request to /updater/restore-db that...

CVE-2025-9993 Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

CVE-2025-9993

The CVE-2025-9993 entry concerns the Bei Fen – WordPress Backup Plugin for WordPress. It describes a Local File Inclusion (LFI) vulnerability exploitable via the task parameter in all versions up to 1.4.2, allowing authenticated users with Subscriber-level access or higher to include and execute ...

CVE-2025-9993: Improper Control of Filename for Include/Require Statement in PHP Program

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

PT-2025-39952

Name of the Vulnerable Software and Affected Versions Bei Fen – WordPress Backup Plugin versions through 1.4.2 Description The Bei Fen – WordPress Backup Plugin for WordPress is susceptible to Local File Inclusion through the task parameter. Attackers with Subscriber-level access or higher can...

PublicCMS 安全漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS PublicCMS-V5.202506.a version and PublicCMS-V5.202506.b version, which stems from incorrect manipulation of the DATABASE, USERNAME, or PASSWORD...