CVE-2025-13370

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

WordPress ProjectList plugin <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload vulnerability

Authenticated Editor+ Arbitrary File Upload vulnerability discovered by Ivan Cese in WordPress Plugin ProjectList versions = 0.3.0...

CVE-2025-13370

CVE-2025-13370 (WordPress ProjectList plugin) is a time-based SQL Injection affecting the ProjectList plugin for WordPress in versions up to and including 0.3.0. The root cause is insufficient escaping of the id parameter and inadequate preparation of the existing SQL query, enabling authenticate...

CVE-2025-13370 ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-13370 ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2025-199566

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2025-199577

The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's...

CVE-2025-12569

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

PT-2025-48004

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-48005

Name of the Vulnerable Software and Affected Versions ProjectList versions prior to 0.3.1 Description The ProjectList plugin for WordPress is susceptible to unauthorized file uploads because of inadequate file type validation. This allows attackers with Editor-level access or higher to upload...

RockyLinux 9 : gimp (RLSA-2025:21968)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:21968 advisory. gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2025-10922 gimp: GIMP ICNS File Parsing Out-Of-Bounds Wri...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability exists in the ILBM file parsing functionality of GIMP. When processing a specially crafted ILBM image file, improper validation of user-supplied data length before copying to a stack buffer can lead to memory corruption. Successful exploitation allows a...

EUVD-2025-198764

Malicious code in orbit-nebula-editor npm...

Malicious code in orbit-nebula-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39053d1e21106bb38ff0f67ad92e018d3e94dd368d8a9df7df45391acd94b852 The package orbit-nebula-editor was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190777 Malicious code in orbit-nebula-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39053d1e21106bb38ff0f67ad92e018d3e94dd368d8a9df7df45391acd94b852 The package orbit-nebula-editor was found to contain malicious code. Source: ghsa-malware...

WordPress S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload vulnerability

Authenticated Editor+ Arbitrary File Upload vulnerability discovered by Ryan Kozak in WordPress Plugin S2B AI Assistant versions = 1.7.8...

PT-2025-47885

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP DCM...

WordPress plugin Guest posting / Frontend Posting / Front Editor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...