WordPress MelaPress Login Security plugin 2.1.0-2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function

Authentication Bypass to Privilege Escalation via getvaliduserbasedontoken Function vulnerability discovered by kr0d in WordPress Plugin MelaPress Login Security versions 2.1.0-2.1.1...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.97 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin GeoDirectory versions = 2.8.97...

CVE-2025-2329 High traffic causes corrupt SPI packets in OpenThread leading to denial of service

In high traffic environments, a Silicon Labs OpenThread RCP see impacted versions fails to clear the SPI transmit buffer and may send a corrupt packet over SPI to its host, causing the host to reset the RCP which results in a denial of service...

WordPress SEOPress for MainWP <= 1.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin SEOPress for MainWP versions = 1.4...

WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana in WordPress Plugin Geo Mashup versions = 1.13.16...

CVE-2025-7022

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022 My Reservation System <= 2.3 - Reflected XSS

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022

The CVE-2025-7022 entry concerns the WordPress plugin My Reservation System (versions ≤ 2.3). The connected data specifies that the plugin does not sanitize/escape a user-supplied parameter before echoing it back to the page, resulting in a Reflected Cross-Site Scripting (XSS) vulnerability that ...

CVE-2025-42947

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on...

WordPress Cena Store Theme <= 2.11.26 is vulnerable to Local File Inclusion

Software Cena Store Type Theme Vulnerable versions = 2.11.26 Fixed in 2.11.27 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48171 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 349bfe1912dd Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

Silicon Labs OpenThread RCP 安全漏洞

Silicon Labs OpenThread RCP is a firmware for a coprocessor from Silicon Labs, USA. A security vulnerability exists in the Silicon Labs OpenThread RCP that stems from a failure to clear the SPI transmit buffer in a high traffic environment, which could result in the sending of corrupted packets...

Cisco Unified Intelligence Center Arbitrary File Upload (cisco-sa-cuis-file-upload-UhNEtStm)

The version of Cisco Unified Intelligence Center installed on the remote host is prior to tested version. It is, therefore, affected by an arbitrary file upload vulnerability as referenced in the cisco-sa-cuis-file-upload-UhNEtStm advisory: - A vulnerability in the web-based management interface ...

PT-2025-30887 · Silicon · Openthread Rcp

Name of the Vulnerable Software and Affected Versions: Silicon Labs OpenThread RCP affected versions not specified Description: In high traffic environments, the RCP fails to clear the SPI transmit buffer, potentially sending a corrupt packet over SPI to its host. This can cause the host to reset...

WordPress Frontend File Manager plugin <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by WordFence in WordPress Plugin Frontend File Manager versions = 21.5...

WordPress Droip plugin <= 2.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Foxyyy in WordPress Plugin Droip versions = 2.2.6...

WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin WooCommerce Point Of Sale POS versions = 1.4...

WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.5.3...

Security Bulletin: Erlang/OTP Vulnerability in KEX Init Handling May Lead to High Memory Usage

Summary Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters...

Fedora 42 : java-21-openjdk / java-25-openjdk / java-latest-openjdk (2025-27b8e92f04)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-27b8e92f04 advisory. security update for July CPU 2025 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Debian: Security Advisory (DLA-4248-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...