9403 matches found
CVE-2025-5237: Improper Neutralization of Input During Web Page Generation
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Astra Linux – Vulnerability in easy-rsa
The weak encryption algorithm in the Easy-RSA version 3.0.5 to 3.1.7 allows a local attacker to more easily brute-force the private CA key when it is created using OpenSSL 3...
CVE-2025-6040
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'efsettingssubmenu' page. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-6040
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'efsettingssubmenu' page. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-6040
The CVE-2025-6040 entry concerns Easy Flashcards for WordPress (versions
CVE-2025-6040 Easy Flashcards <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'efsettingssubmenu' page. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-6040 Easy Flashcards <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'efsettingssubmenu' page. This makes it possible for unauthenticated attackers to update settings and inject...
WordPress plugin Easy Flashcards has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
CVE-2025-6040: Improper Neutralization of Input During Web Page Generation
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'efsettingssubmenu' page. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-46612
The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...
June 11, 2025—KB5063060 (OS Build 26100.4351) Out-of-band
None None...
WordPress Easy Digital Downloads plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Easy Digital Downloads plugin, which stems from the application's lack of effective filtering and escaping of...
WordPress WP Easy Contact plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress WP Easy Contact plugin, which stems from insufficient input cleanup and output escaping, and can be exploited by an...
CVE-2025-46612
The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...
Airleader Master and Airleader Easy security vulnerabilities
Airleader Master and Airleader Easy are both products of Airleader, Inc.Airleader Master is a management device for managing air compressors.Airleader Easy is an air compressor device. A security vulnerability exists in Airleader Master and Airleader Easy versions prior to 6.36 that stems from a...
CVE-2025-46612
The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...
CVE-2025-46612: Unrestricted Upload of File with Dangerous Type
The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...
CVE-2025-46612
The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...
CVE-2025-49435
Cross-Site Request Forgery CSRF vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Easy Allopass: from n/a through = 4.1.1...