CVE-2025-22469

The CVE-2025-22469 entry impacts SATO CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with firmware versions prior to 1.15.5-r1. The vulnerability is an OS command injection in the device’s system, exploitable by a remote attacker with non-administrative privileges to execute arbitrary commands. Th...

CVE-2025-22469

OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus Japan model with the firmware versions prior to 1.15.5-r1. An arbitrary OS command may be executed on the system with a certain non-administrative user privilege...

SATO CL4/6NX Plus和SATO CL4/6NX-J Plus 代码问题漏洞

SATO CL4/6NX Plus and SATO CL4/6NX-J Plus are both series of smart industrial label printers from SATO Japan. A code issue vulnerability exists in the SATO CL4/6NX Plus and SATO CL4/6NX-J Plus versions prior to 1.15.5-r1, which stems from the fact that uploading a specially crafted hazardous file...

OESA-2025-1939 python-Flask-Cors security update

A Flask extension for handling Cross Origin Resource Sharing CORS, making cross-origin AJAX possible. Security Fixes: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching...

OESA-2025-1938 python-Flask-Cors security update

A Flask extension for handling Cross Origin Resource Sharing CORS, making cross-origin AJAX possible. Security Fixes: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching...

WordPress plugin The Plus Addons for Elementor 跨站脚本漏洞

WordPress The Plus Addons for Elementor plugin is a professional extension plugin for Elementor page builder that provides over 120 widgets and extensions with support for WooCommerce store builder, Mega menu, popups and other advanced features. WordPress The Plus Addons for Elementor plugin...

WordPress Affiliate Plus Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress Affiliate Plus, which stems from missing or incorrect random number validation, and can be exploited by an...

CVE-2025-52358

A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's brows...

Vivaldi iCONTROL+ Server 安全漏洞

Vivaldi iCONTROL+ Server is an audio control device from the Italian company Vivaldi. A security vulnerability exists in Vivaldi iCONTROL+ Server 4.7.8.0.eden Logic 5.32 and earlier versions, which originates from an unvalidated error or edit-menu-item parameter and could lead to a cross-site...

PT-2025-33004

Name of the Vulnerable Software and Affected Versions NGINX versions prior to 1.28.1 NGINX versions prior to 1.29.1 Description NGINX Open Source and NGINX Plus are affected by a vulnerability in the ngx mail smtp module. This flaw could allow an unauthenticated attacker to read data from NGINX...

Exploit for CVE-2025-1302

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: po...

CVE-2025-7690

The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'affiplussettings' page. This makes it possible for unauthenticated attackers to perform an unauthorized...

CVE-2025-7690 Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'affiplussettings' page. This makes it possible for unauthenticated attackers to perform an unauthorized...

CVE-2025-7690

CVE-2025-7690 affects the WordPress Affiliate Plus plugin up to version 1.3.2, with a Cross-Site Request Forgery vulnerability caused by missing/incorrect nonce validation on the affiplus_settings page. This can allow unauthenticated attackers to trigger actions on behalf of an administrator if t...

PT-2025-30654 · WordPress · Affiliate Plus

Name of the Vulnerable Software and Affected Versions: Affiliate Plus plugin for WordPress versions up to and including 1.3.2 Description: The Affiliate Plus plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the affiplus settings pag...

WordPress plugin Affiliate Plus 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress Affiliate Plus, which stems from missing or incorrect random number validation, and can be exploited by an...

CVE-2025-5818 Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

CVE-2025-5818

CVE-2025-5818 affects the WordPress plugin Featured Image Plus – Quick & Bulk Edit with Unsplash. Technical details in connected docs confirm an authenticated SSRF in fip_get_image_options() impacting all versions up to 1.6.4 (Wordfence/NVD). Exploitation requires administrator-level access or hi...

WordPress plugin Featured Image Plus – Quick & Bulk Edit with Unsplash 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Featured Image Plu...

PT-2025-30511 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: Featured Image Plus – Quick & Bulk Edit with Unsplash versions prior to 1.6.4 Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to Server-Side Request Forgery via the fip get image...