CVE-2025-1267 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...

CVE-2025-30797

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

CVE-2025-30797 WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

CVE-2025-30797 WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

CVE-2025-30797

CVE-2025-30797: Missing Authorization in Greek Multi Tool (WordPress plugin) – affects Greek Multi Tool – Ultimate Greek Language Toolkit up to version 2.3.1. Root cause is Incorrectly Configured Access Control, enabling unauthorized actions via network access with no privileges required; CVSS v3...

CVE-2025-1267: Improper Neutralization of Input During Web Page Generation

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...

PT-2025-14048 · Unknown · Greek Multi Tool

Name of the Vulnerable Software and Affected Versions: Greek Multi Tool – Fix peralinks, accents, auto create menus and more versions prior to 2.3.1 Description: The issue is related to Missing Authorization, allowing exploitation of incorrectly configured access control security levels...

WordPress plugin Greek Multi Tool has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-30797: Missing Authorization

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

VMware Aria Operations security vulnerabilities

VMware Aria Operations is a unified, AI-driven, self-driving IT operations management platform for private, hybrid, and multi-cloud environments from VMware, Inc. A security vulnerability exists in VMware Aria Operations that stems from a local elevation of privilege...

drivers/md/dm-Data Compromise metadata

Vulnerability of the integritymetadata function in the drivers/md/dm-integrity.c module – The Linux kernel’s driver for supporting multiple devices such as RAID and LVM is vulnerable to a memory leak before the last reference is freed. Exploiting this vulnerability could allow an attacker to caus...

Linux kernel md_check_recovery Heap Buffer Overflow DoS

Vulnerability of the mdcheckrecovery function in the drivers/md/md.c module – The Linux kernel’s device support driver for multiple devices such as RAID and LVM is vulnerable due to improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause system...

CVE-2025-2998

creationtimestamp| type| source ---|---|--- 2025-03-31 14:32:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9662 2025-03-31 17:31:34+00:00| seen| https://t.me/cvedetector/21592 2026-01-19 00:13:20+00:00| seen|...

WordPress Multi Days Events and Multi Events in One Day Calendar plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Pham Van Tam in WordPress Plugin Multi Days Events and Multi Events in One Day Calendar versions = 1.1.3...

CVE-2025-31572

Cross-Site Request Forgery CSRF vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through = 1.1.3...

Beers with Talos: Year in Review episode

Joe, Hazel, Bill and Dave break down Talos' Year in Review 2024 and discuss how and why cybercriminals have been leaning so heavily on attacks that are routed in stealth in simplicity. The team also provide insights into some of the topics of the report, including the top-targeted vulnerabilities...

Available now: 2024 Year in Review

Welcome to Cisco Talos' 2024 Year in Review, available for download now. This report is powered by threat telemetry from over 46 million global devices across 193 countries and regions, amounting to more than 886 billion security events per day. Explore key insights in topics including the top...

PT-2025-13726

Name of the Vulnerable Software and Affected Versions v20202020 Multi Days Events and Multi Events in One Day Calendar versions n/d through 1.1.3 Description The issue is related to a Cross-Site Request Forgery CSRF problem, which affects the Multi Days Events and Multi Events in One Day Calendar...

WordPress plugin Multi Days Events and Multi Events in One Day Calendar has a cross-site request forgeing vulnerability.

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in the WordPress...

CVE-2025-31572: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through = 1.1.3...