17608 matches found
CVE-2025-2799
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes i...
CVE-2025-2799 WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes i...
CVE-2025-2799 WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes i...
WordPress plugin Multi-language Responsive Contact Form has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...
CVE-2025-29000: Missing Authorization
Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Multi-language Responsive Contact Form: from n/a through = 2.8...
PT-2025-33599
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a flaw related to multi-path TCP MPTCP where a race condition can occur between subflow failure and subflow creation. This issue is similar to a previously...
PT-2025-29783 · August Infotech · Multi-Language Responsive Contact Form
Name of the Vulnerable Software and Affected Versions: August Infotech Multi-language Responsive Contact Form versions through 2.8 Description: The Multi-language Responsive Contact Form software contains a missing authorization issue. Access to functionality is not properly constrained by Access...
CVE-2025-4369 Companion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter
The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘updatedelaydays’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-4369
CVE-2025-4369 refers to the Companion Auto Update WordPress plugin. Wordfence notes a stored cross-site scripting vulnerability via the update_delay_days parameter in all versions up to 3.9.2, exploitable by authenticated attackers with administrator privileges. The issue affects multi-site setup...
Malicious code in @indigo-multi/fonts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d045fe7886437131a39046affffbb0dce279fbc6abb9975753462f4c3309edd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in @indigo-multi/fonts
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2025-4369: Improper Neutralization of Input During Web Page Generation
The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘updatedelaydays’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Oracle MySQL resource management error vulnerabilities
Oracle MySQL Server is a relational database from Oracle Corporation. A resource management error vulnerability exists in Oracle MySQL Server, which stems from improper access control on a multi-protocol network and can be exploited by an attacker to cause a denial of service...
OP-SEC Multi-Router Looking Glass Web Detection
Binary data op-secmrlgdetect.nbin...
New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism to Target Multiple Industries
Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan RAT as part of a widespread campaign using a variant of ClickFix called FileFix. "Since May 2025, activity related to the Interlock RAT has been observed in connection with the...
Scattered Spider: Rapid7 Insights, Observations, and Recommendations
Overview of Scattered Spider and recent activity Scattered Spider also tracked as UNC3944, Scatter Swine, Muddled Libra, among other aliases is a financially motivated cybercriminal group active since at least May 2022. The group is notorious for targeting large enterprises — especially...
SEMCMS security vulnerabilities
SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that support multi-language. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of the pid parameter in SEMCMSct.php...
SEMCMS security vulnerabilities
SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that supports multi-language. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of ID parameter in SEMCMSLink.php...
DVFS: a Dynamic Verifiable Fuzzy Search Service for Encrypted Cloud Data
Cloud storage introduces critical privacy challenges for encrypted data retrieval, where fuzzy multi-keyword search enables approximate matching while preserving data confidentiality. Existing solutions face fundamental trade-offs between security and efficiency: linear-search mechanisms provide...
