CVE-2025-4796 Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover

The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the...

Linux Distros Unpatched Vulnerability : CVE-2024-36965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read fro...

CVE-2012-10030

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or...

CVE-2025-34151

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02. The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code...

CVE-2025-34151 Shenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command Injection

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02. The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code...

CVE-2025-50675

GPMAW 14/14.2 is affected by a local, privilege-escalation vulnerability due to insecure default permissions in the installation directory (C:\Program Files\gpmaw). The directory allows full read/write/execute access for Everyone, enabling a non-privileged user to replace or modify critical compo...

Linux Distros Unpatched Vulnerability : CVE-2023-52504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disable KASAN in applyalternatives Fei has reported that KASAN triggers...

CVE-2025-7502

The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-6986

CVE-2025-6986 affects the WordPress plugin FileBird – WordPress Media Library Folders & File Manager (versions prior to 6.4.9). The vulnerability is an authenticated SQL Injection via the search parameter caused by insufficient escaping and poor SQL query preparation, allowing an attacker with Au...

CVE-2013-10070

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can craft a request injecting arbitrary PHP code, leading to command execution under the web server’s context...

CVE-2012-10030

The CVE-2012-10030 entry describes a vulnerability in FreeFloat FTP Server where unauthenticated attackers can upload arbitrary files to sensitive system directories (e.g., C:\ root, system32, wbem\mof). The underlying issue is design flaws that allow unrestricted file uploads and destination pat...

PT-2025-31915 · WordPress · Employee Directory

Name of the Vulnerable Software and Affected Versions: Employee Directory plugin for WordPress versions up to and including 4.5.1 Description: The Employee Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting through the noaccess msg parameter due to insufficient input...

PT-2025-32045 · Kenwood · Kenwood Dmx958Xr

Name of the Vulnerable Software and Affected Versions: Kenwood DMX958XR affected versions not specified Description: This issue allows attackers with physical access to execute arbitrary code on affected Kenwood DMX958XR devices. The flaw resides in the firmware update process due to insufficient...

Pixel Update Bulletin—August 2025Stay organized with collectionsSave and categorize content based on your preferences.

Published August 5, 20225 The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2025-08-05 or later address all issues in this bulletin and all issues in the...

📄 Oracle 19c / 21c Denial of Service

Oracle Database versions 19c and 21c proof of concept exploitation details for CVE-2023-22077. It illustrates that even though the "Lockdown Profile" security feature was in-place to restrict OS accessibility, an attacker is able to cause a denial of service attack that can impact all customers...

LibTIFF 安全漏洞

LibTIFF is a LibTIFF open source library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. LibTIFF version 4.6.0 has a security vulnerability that stems from a null pointer dereference in the function PSLvl2page ...

openSUSE Security Advisory (SUSE-SU-2025:02621-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Pixel Watch Security Bulletin—August 2025Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Watch Security Bulletin contains details of security vulnerabilities affecting Pixel Watch devices Google Devices. For Google devices, security patch levels of 2025-08-05 or later address all issues in this bulletin and all issues in the August 2025 Android Security Bulletin. To learn h...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via iPSLvl2page while converting the image to PostScript Level 2 output. An attacker can cause denial of service by providing a specially crafted TIFF file. Note: This is only exploitable if DEFERSTRILELOAD...

CVE-2025-8488

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savehfecompatibilityoptioncallback function in all versions up to, and including, 2.4.6. This makes it...