7486 matches found
WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Uncanny Toolkit for LearnDash versions = 3.7.0.2...
WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change Vulnerability
Settings Change Vulnerability discovered by ch4r0n in WordPress Plugin Experto CTA Widget Call To Action, Sticky CTA, Floating Button Plugin versions = 1.1.1...
GHSA-GG76-HG3V-5Q6C macroquad vulnerable to multiple soundness issues
Several soundness issues have been reported. Resolving them doesn't seem to be considered a priority. In particular, unprincipled use of mutable statics is pervasive throughout the library, making it possible to cause use-after-free in safe code. Currently, no fixed version is available...
macroquad vulnerable to multiple soundness issues
Several soundness issues have been reported. Resolving them doesn't seem to be considered a priority. In particular, unprincipled use of mutable statics is pervasive throughout the library, making it possible to cause use-after-free in safe code. Currently, no fixed version is available...
WordPress File Manager Advanced Shortcode PRO plugin <= 2.5.6 - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode vulnerability
Authenticated Administrator+ Local JavaScript File Inclusion via Shortcode vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin File Manager Advanced Shortcode PRO versions = 2.5.6...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication due to the improper validation of authentication claims from the WSO2 realm. An attacker can gain unauthorized access and impersonate any user by submitting any username and password combination, even for account...
Improper Input Validation
Overview io.jenkins.plugins:dingding-notifications is a Dingtalk for jenkins. Affected versions of this package are vulnerable to Improper Input Validation due to the unconditional disabling of SSL/TLS certificate and hostname validation for connections. An attacker can intercept and manipulate...
WordPress PeepSo Core: File Uploads plugin <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download vulnerability
Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via filedownload vulnerability discovered by Bikram Kharal in WordPress Plugin PeepSo Core: File Uploads versions = 6.4.6.0...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure due to the improper handling of Smarty syntax errors in CMS pages. An attacker can expose sensitive user information by inducing a Smarty syntax error in a CMS page. Note: The official vendor's hotfix for this issue...
CVE-2025-31205
CVE-2025-31205 targets WebKitGTK/WebKit components across multiple platforms. Affected: WebKitGTK/WebKit-based browsers using the GTK toolkit; vulnerability allows a malicious website to exfiltrate data cross-origin. Root cause: cross-origin data leakage via processing/execution paths in web cont...
WordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerability
Account Takeover vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Subaccounts for WooCommerce versions = 1.6.6...
WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by timomangcut in WordPress Plugin WPFunnels versions = 3.5.18...
UBUNTU-CVE-2025-46718
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges e.g. execution of a single command can list sudo privileges of other users using the -U flag. This vulnerability allows users with limited sudo privileges to enumerat...
Arbitrary Code Injection
Overview unisharp/laravel-filemanager is an A file upload/editor intended for use with Laravel 5 to 6 and CKEditor / TinyMCE. Affected versions of this package are vulnerable to Arbitrary Code Injection through using a valid mimetype and inserting the . character after the php file extension. Thi...
WordPress Contest Gallery plugin <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by stealthcopter in WordPress Plugin Contest Gallery versions = 26.0.6...
UBUNTU-CVE-2025-46336
Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie already a major issue, the session may be restored if the attacker can trigger a lo...
WordPress 워드프레스 결제 심플페이 plugin <= 5.2.11 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin 워드프레스 결제 심플페이 versions = 5.2.11...
WordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Ajax Load More versions = 7.3.1.2...