CVE-2018-20971

The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan...

RedTeamLLM: an Agentic AI Framework for Offensive Security

From automated intrusion testing to discovery of zero-day attacks before software launch, agentic AI calls for great promises in security engineering. This strong capability is bound with a similar threat: the security and research community must build up its models before the approach is leverag...

ThreatLens: LLM-Guided Threat Modeling and Test Plan Generation for Hardware Security Verification

Current hardware security verification processes predominantly rely on manual threat modeling and test plan generation, which are labor-intensive, error-prone, and struggle to scale with increasing design complexity and evolving attack methodologies. To address these challenges, we propose...

CVE-2025-4486

A vulnerability was found in itsourcecode Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=deleteplan. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has bee...

CVE-2025-4464

A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=saveplan. The manipulation of the argument plan leads to sql injection. The attack can be launched remotely...

itsourcecode Gym Management System 安全漏洞

itsourcecode Gym Management System is an open source gym management system by itsourcecode. A security vulnerability exists in itsourcecode Gym Management System version 1.0, which is caused by SQL injection due to the operation of the parameter plan in the file /ajax.php?action=saveplan...

itsourcecode Gym Management System 注入漏洞

itsourcecode Gym Management System is an open source gym management system by itsourcecode. An injection vulnerability exists in itsourcecode Gym Management System version 1.0, which originates from an SQL injection caused by a parameter ID operation in the file /ajax.php?action=deleteplan...

CISA: Dams Sector Waterside Barriers Guide

This guide was developed to assist dam owners and operators in understanding the possible need for waterside barriers as part of their overall security plan. It provides them and security personnel with a cursory level of information on barriers and their use, maintenance considerations, and...

Steps to TruRisk™ – 3: Getting Started—Assessing Business Consequences

“In preparing for battle, plans are useless, but planning is indispensable.” —Dwight D. Eisenhower Prioritization wins battles. Preparation is the difference between a coordinated response and total chaos. Protecting what matters starts with identifying critical systems, understanding the impact,...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

PT-2025-16024 · Unknown · Codelit Courselit

Name of the Vulnerable Software and Affected Versions: CodeLit CourseLit versions prior to 0.57.5 Description: The issue allows Parameter Tampering via a payment plan associated with the wrong entity. Recommendations: For versions prior to 0.57.5, update to version 0.57.5 or later to resolve the...

CourseLit 安全漏洞

CourseLit is a blogging system open-sourced by CodeLit. A security vulnerability exists in versions of CourseLit prior to 0.57.5 that stems from a payment plan associated with the wrong entity that could lead to parameter tampering...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 is affected. The issue is parameter tampering via a payment plan associated with the wrong entity, caused by the payment plan association logic. Impact is described as low (CVSS 3.1: AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Exploitation details are not provided in the...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

CVE-2025-2587

A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. The manipulation of the argument httpOID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-2290

CVE-2025-2290 affects the LifterLMS WordPress plugin (versions up to and including 8.0.1). The issue is an unauthenticated post trashing vulnerability caused by a missing capability check in the delete_access_plan function and related AJAX handlers. Impact per sources is that an unauthenticated a...

WordPress plugin LifterLMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...