WordPress Live sales notification for WooCommerce plugin <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure vulnerability

Missing Authorization to Unauthenticated Customer Data Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Live sales notification for WooCommerce versions = 2.3.39...

SQL Injection Vulnerability in UFIDA BIP Data Application Service of UFIDA Network Technology Co. Ltd (CNVD-C-2025-879635)

UFIDA is a leading provider of management software, ERP software, group management software, human resource management software, customer relationship management software, small business management software, financial and administrative institution management software, automotive industry...

PT-2025-47401

⚠️ CVE-2025-33514 🖥️ W3 Total Cache plugin vulnerability 💬 allows attackers to bypass security controls and potentially execute malicious actions through improperly sanitized parameters in the caching layer 🔗 https://t.co/sjWsZ4lifo The flaw affects W3 Total Cache for WordPress and can expose sites...

PT-2025-47326

Name of the Vulnerable Software and Affected Versions Local Agent DVR versions through 6.6.1.0 Description Local Agent DVR is affected by a directory traversal issue. An unauthenticated local attacker can exploit this to access sensitive information, conduct a server-side forgery request SSRF, or...

PT-2025-47284

Name of the Vulnerable Software and Affected Versions Live sales notification for WooCommerce plugin for WordPress versions prior to 2.3.39 Description The Live sales notification for WooCommerce plugin for WordPress is affected by a missing authorization issue. The getOrders function does not ha...

WordPress WooCommerce Ultimate Points And Rewards plugin Information Disclosure Vulnerability

WordPress WooCommerce Ultimate Points And Rewards plugin is a points and rewards management tool designed for WooCommerce, which awards points through customer behavior e.g., purchases, registrations, comments, etc. and supports redemption of discounts, coupons or free products, aiming to increas...

Student Information System searchquery.php File SQL Injection Vulnerability

Student Information System is a student information system. The Student Information System suffers from a SQL injection vulnerability that originates from the parameter s in the /searchquery.php file that does not effectively filter user input. An attacker can exploit this vulnerability by...

WordPress Survey Maker plugin unauthorized access vulnerability

WordPress Survey Maker plugin is a tool for creating questionnaires with support for multiple question types and data analysis features for businesses or individuals to collect user feedback. An unauthorized access vulnerability exists in the WordPress Survey Maker plugin, which stems from a lack...

PT-2025-47324

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.2.0, 2.3.0, and 2.4.0 through 2.4.0p15 Description Improper permission checks on several REST API endpoints in the software permit users with limited privileges to execute actions they should not be authorized to perform or...

Simple Cafe Ordering System login.php File SQL Injection Vulnerability

Simple Cafe Ordering System is a simple coffee ordering system. The Simple Cafe Ordering System suffers from a SQL injection vulnerability that originates from the /login.php file not securely filtering the Username parameter. An attacker can exploit this vulnerability to remotely obtain sensitiv...

CVE-2025-36460

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An...

CVE-2025-3717

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is n...

Sensitive Information Exposure

com.liferay.portal.template.freemarker is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper data handling in Freemarker templates, where sensitive user data is unintentionally included in the template context, allowing an unauthorized actor to access and potential...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the SysFileApi function. An attacker can access arbitrary files on the server by supplying crafted input to the fileName parameter. Details A Directory Traversal attack also known as path traversal aims to access...

CVE-2025-10460

A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input...

ROS-20251117-04

A vulnerability in the LXD container and lightweight virtual machine management system is related to redundant API data output. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information The vulnerability in the LXD container and...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to insufficient protection of operational data, allows attackers to disclose protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD lies in the insufficient protection of sensitive data at the final endpoint /api/v1/projects/project/detailed. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Divine Vision Han Technology Co., Ltd (CNVD-C-2025-859399)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2025-13200 SourceCodester Farm Management System exposure of information through directory listing

A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation causes exposure of information through directory listing. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2025-59780

CVE-2025-59780 affects the General Industrial Controls Lynx+ Gateway. The connected documents confirm a lack of authentication in the device’s embedded web server, enabling an attacker to send GET requests that could reveal sensitive device information. There are multiple sources (NVD/Red Hat/CNN...