BIT-MOODLE-2024-34002 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

Authentication Bypass

github.com/k3s-io/k3s is vulnerable to unintended unauthenticated access. The vulnerability is due to a Kubernetes kubelet configuration change that, in some cases, sets ReadOnlyPort to 10255, allowing unauthenticated access and potential exposure of credentials...

IBM MQ Container 安全漏洞

IBM MQ Container is a containerized deployment solution for IBM MQ from International Business Machines IBM. A security vulnerability exists in IBM MQ Container that stems from a misconfiguration that could lead to the disclosure of sensitive information...

The lesscss script service allows cache clearing without programming right

Impact The script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this...

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to the misconfiguration of the ReadOnlyPort setting. An attacker can gain unauthorized access to exposed credentials by connecting to the open port without authentication. Remediation...

GHSA-864F-7XJM-2JP2 CNCF K3s Kubernetes kubelet configuration exposes credentials

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...

Dell Trusted Device Elevation of Privilege Vulnerability

Dell Trusted Device is an application from Dell USA. An elevation of privilege vulnerability exists in Dell Trusted Device, which stems from a misconfiguration of the default privileges and can be exploited by an attacker to elevate privileges...

WordPress AnalyticsWP plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin AnalyticsWP versions = 2.1.2...

CVE-2025-23773

Missing Authorization vulnerability in mingocommerce Delete All Posts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Delete All Posts: through 1.1.1...

WordPress plugin Instantio 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Kadence WooCommerce Email Designer versions = 1.5.14...

WordPress Fast eBay Listings plugin <= 2.12.15 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Fast eBay Listings versions = 2.12.15...

CVE-2025-1980

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

CVE-2025-39522 WordPress Dynamic Post <= 4.10 - Settings Change Vulnerability

Missing Authorization vulnerability in Sebastian Lee Dynamic Post allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Dynamic Post: from n/a through 4.10...

CVE-2025-1980 Remote Code Execution via Unrestricted File Upload in Ready_

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

CVE-2025-1980

CVE-2025-1980 concerns the Ready_ application where the Profile section allows uploading files of any type/extension without restriction. If the server is misconfigured (as noted around 2021–2022 deployments), this can lead to Remote Code Execution. The (NVD) entry lists a CRITICAL impact with CV...

CVE-2025-1980 Remote Code Execution via Unrestricted File Upload in Ready_

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions 5.0 through 16.7.1, which stems from a misconfiguration of the message flow and could lead to information disclosure...

Zulip 授权问题漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. An authorization issue vulnerability exists in versions prior to Zulip 10.2, which stems from a single sign-on...

WordPress Real Estate Manager plugin <= 7.3 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by theviper17 in WordPress Plugin Real Estate Manager versions = 7.3...