WordPress LMS Theme <= 9.1 is vulnerable to Cross Site Scripting (XSS)

Software LMS Type Theme Vulnerable versions = 9.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-52799 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fe340a188e96 Credits Ann Required privilege Unauthenticated Published ...

WordPress Seven Stars Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Seven Stars Type Theme Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31067 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9c2cf87e3798 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

WordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by mcdruid in WordPress Plugin eCommerce Product Catalog versions = 3.4.3...

CVE-2025-6410 PHPGurukul Art Gallery Management System edit-art-medium-detail.php sql injection

A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been classified as critical. Affected is an unknown function of the file /admin/edit-art-medium-detail.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotel...

Exploit for Insufficient Session Expiration in Fortinet Fortisase

Fortinet SSL-VPN Session Reuse Vulnerability CVE-2024-50562...

FortiOS SSL-VPN 7.4.4 - Insufficient Session Expiration & Cookie Reuse

!/usr/bin/env python3 """ Exploit Title: FortiOS SSL-VPN 7.4.4 - Insufficient Session Expiration & Cookie Reuse Date: 2025-06-15 Exploit Author: Shahid Parvez Hakim BugB Technologies Vendor Homepage: https://www.fortinet.com Software Link: https://www.fortinet.com/products/secure-sd-wan/fortigate...

[ASA-202506-8] erlang: arbitrary file overwrite

Arch Linux Security Advisory ASA-202506-8 ========================================= Severity: Medium Date : 2025-06-19 CVE-ID : CVE-2025-4748 Package : erlang Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-2900 Summary ======= The package erlang before versi...

WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by LVT-tholv2k in WordPress Plugin Woocommerce Line Notify versions = 1.1.7...

WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin Smart Notification versions = 10.3...

WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Miki Iwamoto in WordPress Plugin Bulk YouTube Post Creator versions = 1.0...

WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by luckybuddy in WordPress Plugin FormLift for Infusionsoft Web Forms versions = 7.5.20...

WordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin School Management versions = 92.0.0...

WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HLog in WordPress Plugin SpecFit-Virtual Try On Woocommerce versions = 8.0.3...

WordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by HLog in WordPress Plugin FastBook versions = 1.1...

WordPress Pixabay Images plugin <= 3.4 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by siavashvafshar in WordPress Plugin Pixabay Images versions = 3.4...

WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Echo RSS Feed Post Generator Plugin for WordPress versions = 5.4.8.1...

WordPress HYDRO Theme <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software HYDRO Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31428 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d4b1bd6f0305 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

PT-2025-26161

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.12.42 llama index.core versions prior to 0.12.42 Description The SimpleDirectoryReader component in llama index.core is subject to uncontrolled memory consumption due to a flaw in resource management. The num...

WordPress Wise Chat plugin <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header vulnerability

Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin Wise Chat versions = 3.3.4...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...