CVE-2025-48242

CVE-2025-48242 describes a Missing Authorization (Broken Access Control) vulnerability in WordPress plugin Legal Pages, affecting versions up to 1.4.5. The issue lies in incorrectly configured access control, enabling unauthorized access due to insufficient authorization checks. Public references...

CVE-2025-48242 WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through = 1.4.5...

Denial Of Service

Next.js is vulnerable to Denial of Service. The vulnerability is due to a race condition in misconfigured Pages Router setups allowing pageProps data to be served instead of standard HTML responses...

WordPress plugin Legal Pages has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2025-48242: Missing Authorization

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through = 1.4.5...

PT-2025-21955 · Unknown · Wpwax Legal Pages

Name of the Vulnerable Software and Affected Versions: wpWax Legal Pages versions 1.4.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For wpWax Legal Pages...

CVE-2025-48112

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through = 1.0...

CVE-2025-4899: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pages/transactionupdate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit...

CVE-2025-1454

The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8759

The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-4815: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/supplierupdate.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The...

CVE-2025-48112

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through = 1.0...

CVE-2025-48112 WordPress Dot html,php,xml etc pages plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in karimmughal Dot html,php,xml etc pages allows Reflected XSS. This issue affects Dot html,php,xml etc pages: from n/a through 1.0...

CVE-2025-4735: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/product.php. The manipulation of the argument Picture leads to unrestricted upload. The attack can be launched...

CVE-2025-4734: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/ciupdate.php. The manipulation of the argument id/name leads to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2025-4746: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/purchasedelete.php. The manipulation of the argument prid leads to sql injection. The attack can be initiated remotely. The exploit has...

CVE-2025-48112: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through = 1.0...

CVE-2025-1454

The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1454

The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8759

The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...