37831 matches found
WordPress Blocksy Companion plugin <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Blocksy Companion versions = 2.1.14...
CVE-2025-54089
CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can interfere with another administrator’s access to the console. The attack complexity is low; there are no attack requirements. Privileges...
CVE-2025-54088
CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate i...
CVE-2025-56019
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy BLE without authentication. Once an unauthorized connection is established, legitimate applications are unable to connect,...
VulnCheck KEV: CVE-2025-20363
A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance ASA Software, Cisco Secure Firewall Threat Defense FTD Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker Cisco ASA and FTD Software...
PT-2025-40918
Name of the Vulnerable Software and Affected Versions IBM Security Verify Access and IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.9.0 IBM Security Verify Access and IBM Security Verify Access Docker versions 11.0.0.0 through 11.0.1.0 Description An unauthenticated user may be...
Pilot Contamination Attacks Detection with Machine Learning for Multi-User Massive MIMO
Massive multiple-input multiple-output MMIMO is essential to modern wireless communication systems, like 5G and 6G, but it is vulnerable to active eavesdropping attacks. One type of such attack is the pilot contamination attack PCA, where a malicious user copies pilot signals from an authentic us...
WordPress Trinity Audio plugin <= 5.20.2 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Moose Love in WordPress Plugin Trinity Audio versions = 5.20.2...
WordPress Majestic Before After Image plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Majestic Before After Image versions = 2.0.2...
WordPress WDesignKit plugin <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function vulnerability
Missing Authentication via wdkithandlereviewsubmission Function vulnerability discovered by Peter Thaleikis in WordPress Plugin WDesignkit versions = 1.2.16...
WordPress TicketSpot plugin <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin TicketSpot versions = 1.0.2...
WordPress Unify plugin <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via unifycheckout Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Unify versions = 3.4.7...
WordPress Backup Bolt plugin <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download vulnerability
Authenticated Admin+ Arbitrary File Download vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Backup Bolt versions = 1.4.1...
WordPress Ultimate Viral Quiz plugin <= 1.0 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by Nabil Irawan in WordPress Plugin Ultimate Viral Quiz versions = 1.0...
WordPress X Addons for Elementor plugin <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Youtube Video ID Field vulnerability discovered by zer0gh0st in WordPress Plugin X Addons for Elementor versions = 1.0.16...
WordPress Notification Bar plugin <= 2.2 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Notification Bar versions = 2.2...
WordPress Smart Docs plugin <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Smart Docs versions = 1.1.1...
EUVD-2025-32429
Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of ...
CVE-2025-54086
CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges require...