41555 matches found
CVE-2025-41674
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
CVE-2025-24938
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access administrator to the application has the potential execute commands on the operating system under the context of the webserver. The vulnerable...
CVE-2025-6174
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...
CVE-2025-6174
The WordPress Qwizcards plugin (versions up to 3.9.4) is affected by a Reflected XSS due to insufficient sanitisation/escaping of the stylesheet parameter(s) when reflected back in the page. Specifically, the vulnerability is described as affecting the _stylesheet parameter (per CVE description) ...
CVE-2025-6174 WordPress Qwizcards <= 3.9.4 - Reflected XSS
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...
CVE-2025-42947
SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on...
CVE-2025-42947 Code Injection vulnerability in SAP FICA ODN framework
SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on...
WordPress VidMov Theme <= 1.9.4 is vulnerable to Local File Inclusion
Software VidMov Type Theme Vulnerable versions = 1.9.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-25172 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 14a25e16a9b7 Credits Bonds Required privilege Unauthenticated Published 2...
WordPress Social Streams plugin <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Thanh Nam Tran in WordPress Plugin Social Streams versions = 1.0.1...
WordPress Realty Portal ā Agent plugin <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function vulnerability
Missing Authorization to Authenticated Subscriber+ Privilege Escalation via rpuserprofile Function vulnerability discovered by theviper17y in WordPress Plugin Realty Portal ā Agent versions = 0.3.9...
CVE-2025-8010
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2025-8010
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2025-8010
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2025-8011
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
WordPress CSS & JavaScript Toolbox plugin < 12.0.3 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Martin Herancourt in WordPress Plugin CSS & JavaScript Toolbox versions 12.0.3...
WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerability
WordPress LoginWP - Pro Plugin = 4.0.8.5 - Settings Change vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin LoginWP - Pro versions = 4.0.8.5...
WordPress WP Links Page plugin <= 4.9.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by timomangcut in WordPress Plugin WP Links Page versions = 4.9.6...
WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Pipes versions = 1.4.3...
WordPress Support Board <= 3.8.0 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Support Board versions = 3.8.0...
CVE-2025-7882
A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the component Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack can only be initiated...