CVE-2025-48236

creationtimestamp| type| source ---|---|--- 2025-05-19 18:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpka2bh7ju2h...

CVE-2025-27010

CVE-2025-27010 is a Local File Inclusion (path traversal) vulnerability in the WordPress theme Tastyc, affecting versions before 2.5.2. The issue (described as a path traversal flaw) can enable PHP Local File Inclusion via certain input paths. Public sources (Patchstack, Red Hat advisory, NVD/NVD...

CVE-2025-4941

creationtimestamp| type| source ---|---|--- 2025-05-19 17:39:15+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16901 2025-07-15 14:32:44+00:00| seen| https://bsky.app/profile/thezdi.bsky.social/post/3ltz4n3ncak2m...

CVE-2025-39394

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.This issue affects AnalyticsWP: from n/a through 2.1.2...

CVE-2025-31262

creationtimestamp| type| source ---|---|--- 2025-05-19 16:39:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16884 2025-05-19 17:13:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpk2zbejjy2t...

WordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Visual Composer Website Builder versions = 45.11.0...

CVE-2025-4931

creationtimestamp| type| source ---|---|--- 2025-05-19 13:13:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpjnnjw4262n...

CVE-2025-4931 projectworlds Online Lawyer Management System user_registation.php sql injection

A vulnerability classified as critical was found in projectworlds Online Lawyer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /userregistation.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. T...

CVE-2025-4930

creationtimestamp| type| source ---|---|--- 2025-05-19 11:38:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16839 2025-05-19 13:13:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpjnnkiteo2o...

CVE-2025-4825

A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The...

CVE-2025-47760

creationtimestamp| type| source ---|---|--- 2025-05-19 08:38:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16820 2025-05-19 09:13:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpjaa24zye2h...

CVE-2025-1627

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-4907

creationtimestamp| type| source ---|---|--- 2025-05-19 03:38:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16799 2025-05-19 05:13:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpissinmex2p...

CVE-2025-23164

creationtimestamp| type| source ---|---|--- 2025-05-19 02:38:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16794 2025-05-19 05:13:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpisshpbfi24 2026-07-12 22:00:07+00:00| seen| https://t.me/securixykz/1146 2026-07-13...

WordPress Sensei LMS plugin < 4.20.0 - Teacher+ Users Email Address Disclosure vulnerability

Teacher+ Users Email Address Disclosure vulnerability discovered by Li Xuhang in WordPress Plugin Sensei LMS versions 4.20.0...

CVE-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...

WordPress WP ERP plugin < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information vulnerability

Custom+ Unauthorized Access to Terminated Employee Information vulnerability discovered by Pedro Cuco Illex in WordPress Plugin WP ERP versions 1.13.4...

CVE-2025-4894

creationtimestamp| type| source ---|---|--- 2025-05-18 20:37:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16777 2025-05-18 21:13:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lphxxhziip2s...

CVE-2025-39507

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through 6.4.4...

CVE-2025-48219

O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS IP Multimedia Subsystem call and then reading the utran-cell-id-3gpp field of a Cellular-Network-Info SIP header, aka an ECI E-UTRAN Cell Identity leak. The Cell ID might be usable to...