Authentication Bypass

Mattermost is vulnerable to Authentication Bypass. The vulnerability is due to improper enforcement of multi-factor authentication MFA due to a flaw that allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes...

What’s New in Rapid7 Products & Services: Q1 2025 in Review

At Rapid7, we started off the year focused on delivering new features and advancements across our products and services to bring you the context needed to prioritize exposures, visualize your attack surface, and accelerate incident response. Read on for Q1 2025 release highlights across the Comma...

CVE-2025-1267

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...

CVE-2025-1267 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...

CVE-2025-1267

CVE-2025-1267 – Groundhogg WordPress plugin vulnerability: stored XSS via the label parameter in versions up to 3.7.4.1. Exploitation requires Administrator+ privileges and can cause arbitrary script execution in pages viewed by users on multisite installations or where unfiltered_html is disable...

CVE-2025-1267 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...

CVE-2025-1267 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to...

CVE-2025-30797

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

CVE-2025-30797 WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

CVE-2025-30797 WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more...

CVE-2025-30797

CVE-2025-30797: Missing Authorization in Greek Multi Tool (WordPress plugin) – affects Greek Multi Tool – Ultimate Greek Language Toolkit up to version 2.3.1. Root cause is Incorrectly Configured Access Control, enabling unauthorized actions via network access with no privileges required; CVSS v3...

WordPress plugin Greek Multi Tool 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-14048 · Unknown · Greek Multi Tool

Name of the Vulnerable Software and Affected Versions: Greek Multi Tool – Fix peralinks, accents, auto create menus and more versions prior to 2.3.1 Description: The issue is related to Missing Authorization, allowing exploitation of incorrectly configured access control security levels...

Vulnerability of the integritymetadata() function in the drivers/md/dm-integrity.c module – The driver for supporting multiple devices (such as RAID and LVM) in the Linux kernel allows a hacker to trigger a service failure.

Vulnerability of the integritymetadata function in the drivers/md/dm-integrity.c module – The Linux kernel’s driver for supporting multiple devices such as RAID and LVM is vulnerable to a memory leak before the last reference is freed. Exploiting this vulnerability could allow an attacker to caus...

Vulnerability of the md_check_recovery() function in the drivers/md/md.c module – The driver for supporting multiple devices (RAID and LVM) in the Linux kernel allows a hacker to trigger a service failure.

Vulnerability of the mdcheckrecovery function in the drivers/md/md.c module – The Linux kernel’s device support driver for multiple devices such as RAID and LVM is vulnerable due to improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause system...

VMware Aria Operations 安全漏洞

VMware Aria Operations is a unified, AI-driven, self-driving IT operations management platform for private, hybrid, and multi-cloud environments from VMware, Inc. A security vulnerability exists in VMware Aria Operations that stems from a local elevation of privilege...

CVE-2025-2998

creationtimestamp| type| source ---|---|--- 2025-03-31 14:32:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9662 2025-03-31 17:31:34+00:00| seen| https://t.me/cvedetector/21592 2026-01-19 00:13:20+00:00| seen|...

WordPress Multi Days Events and Multi Events in One Day Calendar plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Pham Van Tam in WordPress Plugin Multi Days Events and Multi Events in One Day Calendar versions = 1.1.3...

CVE-2025-31572

Cross-Site Request Forgery CSRF vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through = 1.1.3...

Beers with Talos: Year in Review episode

Joe, Hazel, Bill and Dave break down Talos' Year in Review 2024 and discuss how and why cybercriminals have been leaning so heavily on attacks that are routed in stealth in simplicity. The team also provide insights into some of the topics of the report, including the top-targeted vulnerabilities...