CVE-2025-27823

An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent spambots from collecting them. The module doesn't sufficiently validate the data attribute value on links, potentially leading to a Cross Si...

CVE-2024-12035

CVE-2024-12035 affects the CS Framework WordPress plugin. Vulnerable in all versions up to 6.9 (per initial description) and up to 7.0 per CVE listings, due to insufficient file path validation in cs_widget_file_delete(). An authenticated attacker with Subscriber+ privileges can delete arbitrary ...

CVE-2024-12035 CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion

The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cswidgetfiledelete function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to dele...

WordPress plugin CS Framework 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

Server Side Request Forgery (SSRF)

github.com/usememos/memos is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs, which allows an attacker to perform SSRF attacks...

Debian dsa-5873 : fonts-opensymbol - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5873 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5873-1 [email protected] https://www.debian.org/security/...

[SECURITY] [DSA 5873-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5873-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 04, 2025 https://www.debian.org/security/faq -...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

CVE-2024-13910 Database Backup and check Tables Automated With Scheduler 2024 <= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion

The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'databasebackupajaxdelete' function in all versions up to, and including, 2.35. This makes it possible for authenticated...

CVE-2024-13910

CVE-2024-13910 affects the WordPress plugin “Database Backup and check Tables Automated With Scheduler 2024” (Database Backup, plugin versions

CVE-2025-22952

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...

CVE-2025-20161

A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

CVE-2025-0764

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher...

CVE-2025-1282

The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletepostphoto and addcar functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers,...

CVE-2025-1282

CVE-2025-1282 affects the Car Dealer Automotive WordPress Theme – Responsive (WordPress Theme) up to version 1.6.3. The vulnerability arises from insufficient file path validation in delete_post_photo() and add_car(), allowing authenticated users with Subscriber+ privileges to delete arbitrary se...

CVE-2024-2297

The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the createautosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above...

CVE-2024-2297 Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave

The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the createautosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above...

CVE-2024-2297

The Bricks WordPress theme (Bricks) is vulnerable to authenticated Privilege Escalation via the create_autosave AJAX function in versions up to and including 1.9.6.1. Exploitation requires Post Builder to be enabled, builder access for contributor-level users, and Code Execution enabled for admin...

CVE-2025-22952

Elestio Memos (v0.23.0) is affected by CVE-2025-22952: a Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs. The Nuclei template confirms the issue as applicable to MEMOS versions up to 0.24.0 and notes that unauthenticated attackers can exploit SSRF to access...