CVE-2025-10786 Campcodes Grocery Sales and Inventory System ajax.php sql injection

A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=deleteuser. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be us...

SingleStore: Delete any folder for any user within the organization

A vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folderid parameter in DELETE requests. The vulnerability was rated CVSS 3.0 Low 3.8 due to high attack complexity requiring...

CVE-2025-10305

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-58704: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.4...

PT-2025-38982

Name of the Vulnerable Software and Affected Versions Ren Ventura WP Delete User Accounts versions through 1.2.4 Description The software contains a flaw related to improper handling of user-supplied data when creating web pages, which can lead to Stored Cross-Site Scripting XSS. This allows an...

PT-2025-38693

Name of the Vulnerable Software and Affected Versions Campcodes Grocery Sales and Inventory System version 1.0 Description A flaw exists in Campcodes Grocery Sales and Inventory System 1.0. The vulnerability is due to SQL injection within unknown code in the file /ajax.php?action=delete user...

WordPress plugin WP Delete User Accounts: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-site...

D-Link DSL7740C DELT_file.xgi Heap Buffer Overflow

The vulnerability of the DELTfile.xgi function in the D-Link DSL7740C router microprogramming system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain read, modify, delete data, and alter device settings remotely...

PT-2025-38706

Name of the Vulnerable Software and Affected Versions code-projects E-Commerce Website version 1.0 Description A flaw exists in code-projects E-Commerce Website 1.0 where manipulation of the user id argument in the file '/pages/admin account delete.php' can lead to SQL injection. This issue is...

Code-Projects E-Commerce Website SQL Injection Vulnerabilities

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of the userid parameter in the file /pages/adminaccountdelete.php for externally entered SQL statements. An attacker can exploit this vulnerabilit...

CVE-2025-9949 Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery

The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...

CVE-2025-9949

CVE-2025-9949 (Internal Links Manager for WordPress) is a CSRF vulnerability present in all versions up to 3.0.1 due to missing or incorrect nonce validation in the link deletion path (process_bulk_action). This allows unauthenticated attackers to delete SEO links by tricking an administrator int...

CVE-2025-10305 Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305

CVE-2025-10305 documents a vulnerability in the WordPress Secure Passkeys plugin (versions up to and including 1.2.1) where delete_passkey() and passkeys_list() lack proper authorization checks. This allows authenticated users with Subscriber+ privileges to view and delete passkeys. The issue has...

CVE-2025-9949: Cross-Site Request Forgery (CSRF)

The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...

PT-2025-38630

Name of the Vulnerable Software and Affected Versions Secure Passkeys plugin for WordPress versions up to and including 1.2.1 Description The Secure Passkeys plugin for WordPress is susceptible to unauthorized access due to a missing capability check within the delete passkey and passkeys list...

CVE-2025-10627

A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/deleteuser.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may ...

SUSE CVE-2025-39859

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix use-after-free bugs causing by ptpocpwatchdog The ptpocpdetach only shuts down the watchdog timer if it is pending. However, if the timer handler is already running, the timerdeletesync is not called. This leads to...

CVE-2025-59345

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create...

CVE-2025-10602

A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/deletes1.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been...