📄 WonderCMS 3.4.2 Shell Upload

Proof of concept exploit for an authentication shell upload vulnerability in WonderCMS version 3.4.2. ============================================================================================================================================= | Title : WonderCMS 3.4.2 Authenticated file upload...

📄 WordPress AI Engine 3.1.3 Mass Enumeration

This advisory documents a fully automated PHP-based exploitation framework designed to perform mass enumeration, plugin detection, token extraction, and automated account creation targeting vulnerable WordPress MCP-related REST API endpoints...

Docker CLI security vulnerabilities

Docker CLI is a command-line management tool for containerized applications, open-sourced by Docker. Versions of Docker CLI prior to 29.1.5 contain security vulnerabilities. These vulnerabilities stem from an insecure search path for plugin binary files on Windows, which could allow low-privilege...

CVE-2025-15558: Uncontrolled Search Path Element

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries docker-compose.exe, docker-buildx.exe, etc. that are executed when a...

OpenClaw plugin runtime command execution is part of trusted plugin boundary

Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution runtime.system.runCommandWithTimeout. Impact Plugins already execute with the same OS privileges as the OpenClaw process...

GHSA-FF98-W8HJ-QRXF OpenClaw plugin runtime command execution is part of trusted plugin boundary

Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution runtime.system.runCommandWithTimeout. Impact Plugins already execute with the same OS privileges as the OpenClaw process...

org.apache.ranger:conditions-enrichers (0.6.2), org.apache.ranger:embeddedwebserver (0.6.2) +21 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.6.2)

org.apache.ranger:ranger-plugins-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.ranger:conditions-enrichers 0.6.2 - org.apache.ranger:embeddedwebserve...

org.apache.nifi:nifi-ranger-nar (>=1.8.0, <=1.10.0), org.apache.nifi:nifi-ranger-plugin (>=1.8.0, <=1.10.0) +24 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (1.0.0)

org.apache.ranger:ranger-plugins-common MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi:nifi-ranger-nar =1.8.0, =1.8.0, =1.10.0 -...

io.cdap.cdap:cdap-ranger-binding (>=0.18.0, <=0.19.0), org.apache.ranger:conditions-enrichers (0.7.0) +22 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.7.0)

org.apache.ranger:ranger-plugins-common MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - io.cdap.cdap:cdap-ranger-binding =0.18.0, =0.19.0 -...

com.expediagroup.apiary:apiary-ranger-metastore-plugin (>=7.2.1, <=8.2.7), com.witboost.provisioning:scala-mesh-ranger_2.13 (1.0.0) +64 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (>=2.0.0, <=2.7.0)

org.apache.ranger:ranger-plugins-common MAVEN version =2.0.0, =7.2.1, =0.8.44-4rc1, =466, =0.6.0-incubating, =0.8.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =0.7.0, =0.7.0, =1.11.0, =1.11.0, =2.0.0, =1.3.0, =1.3.0, =2.0.0 and more Source cves: CVE-2025-59059 Source advisory:...

com.expediagroup.apiary:apiary-ranger-metastore-plugin (>=7.2.1, <=8.2.7), com.witboost.provisioning:scala-mesh-ranger_2.13 (1.0.0) +64 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (>=2.0.0, <=2.7.0)

org.apache.ranger:ranger-plugins-common MAVEN version =2.0.0, =7.2.1, =0.8.44-4rc1, =466, =0.6.0-incubating, =0.8.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =0.7.0, =0.7.0, =1.11.0, =1.11.0, =2.0.0, =1.3.0, =1.3.0, =2.0.0 and more Source cves: CVE-2025-59059 Source advisory:...

com.expediagroup.apiary:apiary-ranger-metastore-plugin (>=7.2.1, <=8.2.7), com.witboost.provisioning:scala-mesh-ranger_2.13 (1.0.0) +64 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (>=2.0.0, <=2.7.0)

org.apache.ranger:ranger-plugins-common MAVEN version =2.0.0, =7.2.1, =0.8.44-4rc1, =466, =0.6.0-incubating, =0.8.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =0.7.0, =0.7.0, =1.11.0, =1.11.0, =2.0.0, =1.3.0, =1.3.0, =2.0.0 and more Source cves: CVE-2025-59059 Source advisory:...

org.apache.ranger:conditions-enrichers (1.2.0), org.apache.ranger:embeddedwebserver (1.2.0) +25 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (1.2.0)

org.apache.ranger:ranger-plugins-common MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.ranger:conditions-enrichers 1.2.0 - org.apache.ranger:embeddedwebserve...

org.apache.nifi.registry:nifi-registry-ranger-assembly (>=0.3.0, <=0.5.0), org.apache.nifi.registry:nifi-registry-ranger-plugin (>=0.3.0, <=0.5.0) +26 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (1.1.0)

org.apache.ranger:ranger-plugins-common MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi.registry:nifi-registry-ranger-assembly =0.3.0, =0.3.0, =0.5.0 -...

org.apache.nifi:nifi-ranger-nar (>=1.4.0, <=1.7.1), org.apache.nifi:nifi-ranger-plugin (>=1.4.0, <=1.7.1) +23 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.7.1)

org.apache.ranger:ranger-plugins-common MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi:nifi-ranger-nar =1.4.0, =1.4.0, =1.7.1 -...

org.apache.ranger:conditions-enrichers (0.6.3), org.apache.ranger:embeddedwebserver (0.6.3) +21 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.6.3)

org.apache.ranger:ranger-plugins-common MAVEN version 0.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.ranger:conditions-enrichers 0.6.3 - org.apache.ranger:embeddedwebserve...

org.apache.nifi:nifi-ranger-nar (>=1.1.0, <=1.3.0), org.apache.nifi:nifi-ranger-plugin (>=1.1.0, <=1.3.0) +23 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.6.0)

org.apache.ranger:ranger-plugins-common MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi:nifi-ranger-nar =1.1.0, =1.1.0, =1.3.0 -...

org.apache.ranger:conditions-enrichers (0.6.1), org.apache.ranger:embeddedwebserver (0.6.1) +21 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.6.1)

org.apache.ranger:ranger-plugins-common MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.ranger:conditions-enrichers 0.6.1 - org.apache.ranger:embeddedwebserve...

com.expediagroup.apiary:apiary-ranger-metastore-plugin (>=7.2.1, <=8.2.7), com.witboost.provisioning:scala-mesh-ranger_2.13 (1.0.0) +67 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (>=0.6.0, <=2.7.0)

org.apache.ranger:ranger-plugins-common MAVEN version =0.6.0, =7.2.1, =0.8.44-4rc1, =0.18.0, =466, =0.6.0-incubating, =0.8.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =0.3.0, =0.3.0, =1.1.0, =1.1.0, =2.0.0, =1.3.0, =2.0.0 and more Source cves: CVE-2025-59059 Source advisory:...

CVE-2026-2568

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possib...