CVE-2024-13425

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete function due to missing validation on a user controlled key. This makes it...

CVE-2025-0939

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the JSONFileDocumentDatabase during delete and update operations. Remediation Upgrade parlant to version 1.4.2 or higher. References - GitHub Commit...

PT-2025-2265 · WordPress · Woocommerce Support Ticket System

Name of the Vulnerable Software and Affected Versions: WooCommerce Support Ticket System plugin for WordPress versions up to, and including, 17.8 Description: The issue is related to missing capability checks on the ajax delete message, ajax get customers partial list, and ajax get admins list...

CVE-2025-21674 net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable IPsec packet offload in tunnel mode in debug kernel generates the following kernel panic, which is happening due to two issues: 1. In SA ad...

Malicious code in delete-deployments (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e14b7ca7c288fe08d7f1e3a9382e6ef56ba7abf1a6c684fee76f737dbfc2d171 Any computer that has this package installed or running should be considered...

MAL-2025-706 Malicious code in delete-deployments (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e14b7ca7c288fe08d7f1e3a9382e6ef56ba7abf1a6c684fee76f737dbfc2d171 Any computer that has this package installed or running should be considered...

PT-2025-2209 · WordPress · The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login Url – Sign In

Name of the Vulnerable Software and Affected Versions: The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordPress versions up to, and including, 7.1.1 Description: The issue is related to...

WordPress plugin Custom Login Page Styler 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2024-13707

The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gkyimageuploadermainfunction function. This makes it possible for unauthenticated attackers to delete...

PT-2025-2252 · WordPress · Wp Image Uploader

Name of the Vulnerable Software and Affected Versions: WP Image Uploader plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Cross-Site Request Forgery, which is possible due to missing or incorrect nonce validation in the gky image uploader main functio...

PT-2025-1664 · WordPress · Borderless – Widgets

Name of the Vulnerable Software and Affected Versions: Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress versions up to, and including, 1.5.9 Description: The issue is related to a missing capability check on the remove zipped font function,...

The vulnerability of the Entity Delete Log module in the Drupal CMS system, related to improper authentication, allows attackers to bypass security restrictions and execute a forced browsing attack.

The vulnerability of the Entity Delete Log module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

The vulnerability of the command-line interface (CLI) of the FortiRecorder surveillance system’s microprogramming software allows a perpetrator to gain access to read, modify, and delete any files they desire.

The vulnerability of the command-line interface CLI of the FortiRecorder surveillance system software relates to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability can allow an attacker to gain read, modify, and delete access to arbitrary fil...

The vulnerability of the __xfrm_state_delete() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the xfrmstatedelete function in the Linux operating system is related to operations involving resources after their expiration or release. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the IBM Sterling Secure Proxy proxy server arises from the improper assignment of permissions for the critical resource. This allows a malicious actor to gain unauthorized access to read, modify, or delete data.

The vulnerability of the IBM Sterling Secure Proxy proxy server is related to the improper assignment of permissions for the critical resource. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data...

CVE-2024-12113

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteuserreview and deletereview functions in all versions up to, and including, 1.3.2. This...

WordPress plugin Youzify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-1752 · WordPress · Youzify – Buddypress Community

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized loss of data due to a missing capability check on the...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP versions prior to 2024.12.492.0 that stems from improper privilege management. An attacker could exploit the vulnerability t...