CVE-2025-5754

The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress plugin Block Editor Gallery Slider security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2025-7472

A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM...

CVE-2024-13972

A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSTEM level privileges during a product upgrade...

CVE-2025-7472

CVE-2025-7472 describes a local privilege escalation in Sophos Intercept X for Windows installer prior to 1.22. If the installer is run with SYSTEM privileges, a local user may gain system-level access. Affected component: Intercept X for Windows installer; root cause: privilege escalation when t...

CVE-2025-7472

A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM...

CVE-2025-5345 Exposed AIDL service allowing to read and delete files with system-level privileges in Bluebird filemanager application

Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardRemoteService". A local attacker can bind to the AIDL-type service to copy and delete arbitrary files from device's storage with system-lev...

CVE-2025-5345 Exposed AIDL service allowing to read and delete files with system-level privileges in Bluebird filemanager application

Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardRemoteService". A local attacker can bind to the AIDL-type service to copy and delete arbitrary files from device's storage with system-lev...

PT-2025-29963 · Sophos · Intercept X For Windows

Name of the Vulnerable Software and Affected Versions: Intercept X for Windows versions prior to 1.22 Description: A local privilege escalation issue exists in the Intercept X for Windows installer. If the installer is executed with SYSTEM privileges, a local user may gain system-level access...

CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

PT-2025-29808 · Unknown · Alexvtn Internal Linking Of Related Contents

Name of the Vulnerable Software and Affected Versions: alexvtn Internal Linking of Related Contents versions n/a through 1.1.8 Description: A missing authorization issue exists in alexvtn Internal Linking of Related Contents, allowing exploitation of incorrectly configured access control security...

PT-2025-44093

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-rc5-c1610d2d66b1-next-vm Description The Linux kernel contains an issue within the KVM component related to handling L1 intercepts during userspace I/O completion. Specifically, the kernel may recheck L1...

The vulnerability of the NetMRI network monitoring program, related to the failure to take measures for data cleaning at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the NetMRI network monitoring program lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

3S-Attack: Spatial, Spectral and Semantic Invisible Backdoor Attack against DNN Models

Backdoor attacks involve either poisoning the training data or directly modifying the model in order to implant a hidden behavior, that causes the model to misclassify inputs when a specific trigger is present. During inference, the model maintains high accuracy on benign samples but misclassifie...

PT-2025-29461 · One Identity · One Identity Password Manager

Name of the Vulnerable Software and Affected Versions: One Identity Password Manager versions prior to 5.14.4 Description: The Secure Password extension in One Identity Password Manager contains a flaw in its security hardening mechanism within the kiosk browser used for the Password Self-Service...

[SECURITY] Fedora 41 Update: perl-5.40.2-516.fc41

Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

Exploit for SQL Injection in Fortinet Fortiweb

CVE-2025-25257 — FortiWeb Critical SQL Injection Vulnerability...

CVE-2025-7504 Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection

The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the queryvars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is prese...

CVE-2025-4972

Removed by vendor...

GitLab 18.0 < 18.0.4 / 18.1 < 18.1.2 (CVE-2025-4972)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass...