Microsoft PC Manager 后置链接漏洞

Microsoft PC Manager is a computer management software from Microsoft USA that allows one-click acceleration, system space management, pop-up window management, and full health check. Microsoft PC Manager suffers from a backlink vulnerability. An attacker can exploit this vulnerability to elevate...

WordPress plugin 1 Click WordPress Migration Plugin 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

WhatsApp hack: Meta wins payout over NSO Group spyware

Meta has won almost $170m in damages from Israel-based NSO Group, maker of the Pegasus spyware. The ruling comes after a six-year legal case against the company after Meta accused it of misusing its servers to spy on users. According to the original complaint against NSO Group, filed in October...

Right-Click Execution - Windows LNK File Special UNC Path NTLM Leak

This module creates a malicious Windows shortcut LNK file that specifies a special UNC path in EnvironmentVariableDataBlock of Shell Link .LNK that can trigger an authentication attempt to a remote server. This can be used to harvest NTLM authentication credentials. When a victim right-click the...

click-clack (>=0.1.0 <=0.2.1), paos (>=1.2.7 <=1.2.10) +1 more potentially affected by unknown CVE via marimo (>=0.10.19 <=0.11.31)

marimo PYPI version =0.10.19, =0.1.0, =1.2.7, =0.1.1.dev1736307293, =0.1.1.dev1742453945 Source cves: unknown CVE Source advisory: SNYK:PYTHON-MARIMO-12671196...

CVE-2025-39548

Cross-Site Request Forgery CSRF vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through = 1.1.17...

M&S Cyberattack Disrupts Contactless Payments and Click & Collect Services

Marks & Spencer M&S cyberattack disrupts contactless payments and Click & Collect; investigation launched as retailer apologises and…...

CVE-2025-39548

Cross-Site Request Forgery CSRF vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through = 1.1.17...

CVE-2025-39548

CVE-2025-39548 corresponds to a CSRF-to-Stored XSS vulnerability in the WordPress plugin Right Click Disable OR Ban (versions up to and including 1.1.17). The connected sources confirm the vulnerability can be triggered via CSRF and leads to stored XSS, affecting the plugin’s behavior. A fix is a...

CVE-2025-39548 WordPress Right Click Disable OR Ban plugin <= 1.1.17 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through = 1.1.17...

WordPress plugin Right Click Disable OR Ban 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

ash_authentication has email link auto-click account confirmation vulnerability

Impact The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow these links, unintentionally confirming the account. This...

CVE-2025-32640

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This issue affects Ally: from n/a through = 3.1.0...

1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data...

CVE-2025-32640

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This issue affects Ally: from n/a through = 3.1.0...

CVE-2025-32550

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1...

CVE-2025-32550 WordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1...

CVE-2025-32550 WordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1...

CVE-2025-32550

CVE-2025-32550 is an unauthenticated SQL Injection in Click & Pledge Connect Plugin for WordPress. Affected: Click & Pledge Connect Plugin versions 2.24080000 up to WP6.6.1. The issue is cataloged with CVSS v3.1 base score 7.2 (High) and a network attack vector with no user interaction and change...

CVE-2025-32640

CVE-2025-32640 is a stored XSS in the WordPress plugin Ally – Web Accessibility & Usability (One Click Accessibility). The issue affects the One Click Accessibility component up to version 3.1.0 and requires authenticated access (Administrator+) to exploit. The connected Wordfence disclosure list...