VulnCheck KEV: CVE-2015-20125

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile. Attackers can send GET requests to asposepdfexporterdownload.php with traversal sequence...

VulnCheck KEV: CVE-2015-20124

Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to asposeimportexportdownload.php with traversal sequences lik...

VulnCheck KEV: CVE-2015-20123

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile. Attackers can send GET requests to asposedocexporterdownload.php with the 'file' parameter set to...

VulnCheck KEV: CVE-2014-125134

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitiv...

VulnCheck KEV: CVE-2014-125133

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...

VulnCheck KEV: CVE-2014-125132

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with maliciou...

VulnCheck KEV: CVE-2012-20005

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

VulnCheck KEV: CVE-2012-20004

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

VulnCheck KEV: CVE-2012-20003

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

Can Quantum Layers Offer Performance and Security Advantages in Vision-Language Models?

As quantum computing moves from the noisy intermediate-scale quantum NISQ era toward early fault-tolerant quantum computing EFTQC, quantum-enhanced AI is shifting from a conceptual idea to experimental research. Quantum components are expected to extend the capabilities of existing AI systems, ye...

PT-2026-118243

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

PT-2026-118241

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' a...

PT-2026-118295

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza...

PT-2026-118468

Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...

PT-2026-120311

Summary Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session including passport.user with no credentials. Details...

PT-2026-120292

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri =...

PT-2026-118582

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 ApostropheCMS login-recaptcha versions prior to 1.2.1 ApostropheCMS login-hcaptcha versions prior to 1.3.0 Description CAPTCHA integrations in the Form, login-recaptcha, and login-hcaptcha modules...

PT-2026-118676

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with maliciou...

PT-2026-118680

Name of the Vulnerable Software and Affected Versions Aspose Importer & Exporter plugin for WordPress versions prior to 3.0 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This occurs because the file parameter is not properly sanitized. Attackers...

PT-2026-118678

Name of the Vulnerable Software and Affected Versions ChurcHope theme for WordPress versions prior to 2.2 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This is achieved by supplying directory traversal sequences to the file parameter of the...