PT-2025-16804

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. This can result in such tags being marked as self-closing when...

FatalRAT Phishing Attacks Target APAC Industries Using Chinese Cloud Services

Various industrial organizations in the Asia-Pacific APAC region have been targeted as part of phishing attacks designed to deliver a known malware called FatalRAT. "The threat was orchestrated by attackers using legitimate Chinese cloud content delivery network CDN myqcloud and the Youdao Cloud...

CVE-2025-24540: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through = 6.18.9...

Oracle Primavera P6 Enterprise Project Portfolio Management (January 2025 CPU)

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and...

CVE-2025-23500: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in faaiq Simple Custom post type custom field simple-content-construction-kit allows Reflected XSS.This issue affects Simple Custom post type custom field: from n/a through = 1.0.3...

CVE-2025-21526

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 and 23.12.1.0-23.12.10.0. Easily exploitable...

Oracle Construction and Engineering Suite 安全漏洞

Oracle Construction and Engineering Suite is a portfolio management solution suite product for construction projects from Oracle Corporation USA. A security vulnerability exists in Oracle Construction and Engineering Suite. An attacker could exploit the vulnerability to update, insert, or delete...

Oracle Construction and Engineering Suite 安全漏洞

Oracle Construction and Engineering Suite is a portfolio management solution suite product for construction projects from Oracle Corporation USA. A security vulnerability exists in Primavera P6 Enterprise Project Portfolio Management for Oracle Construction and Engineering Suite. An attacker coul...

WordPress Mojo Under Construction Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Mojo Under Construction versions = 1.1.2...

WordPress Eazy Under Construction Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Eazy Under Construction versions = 1.0...

CVE-2024-37508

Cross-Site Request Forgery CSRF vulnerability in Rara Theme Construction Landing Page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through 1.3.5...

CVE-2024-37508

Cross-Site Request Forgery CSRF vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through = 1.3.5...

CVE-2024-37508 WordPress Construction Landing Page theme <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through = 1.3.5...

CVE-2024-37508 WordPress Construction Landing Page theme <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through = 1.3.5...

CVE-2024-37508

CVE-2024-37508 affects the WordPress Construction Landing Page theme, versions

CVE-2024-37508: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through = 1.3.5...

PT-2025-2498

Name of the Vulnerable Software and Affected Versions: Rara Theme Construction Landing Page versions 1.3.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by...

WordPress plugin Construction Landing Page 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal

Summary Improper input validation in the application can allow attackers to perform local file read LFR or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd o...

The vulnerability of AdvaBuild software for designing and managing construction projects lies in the insufficient protection of command queues, allowing attackers to open arbitrary files.

The vulnerability of AdvaBuild software for designing and managing construction projects is related to insufficient protection of the command queue. Exploiting this vulnerability could allow a malicious actor to open arbitrary files...