PT-2025-39945

Name of the Vulnerable Software and Affected Versions Copypress Rest API plugin for WordPress versions 1.1 through 1.2 Description The Copypress Rest API plugin for WordPress is susceptible to Remote Code Execution through the copyreap handle image function. The plugin utilizes a hard-coded JWT...

CVE-2025-36352

IBM License Metric Tool (ILMT) versions 9.2.0–9.2.40 are vulnerable to stored cross-site scripting (CXS) in the Web UI, exploitable by an authenticated user and potentially leading to credentials disclosure in a trusted session. The issue is tied to IBM’s advisory and public CVE-2025-36352 record...

mysql: InnoDB unspecified vulnerability (CPU Apr 2025)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

WordPress Greenify theme <= 2.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Greenify versions = 2.2...

CVE-2025-11010 vstakhov libucl ucl_util.c ucl_include_common heap-based overflow

A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function uclincludecommon of the file /src/uclutil.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the...

CVE-2025-60157 WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Stored XSS.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a throu...

CVE-2025-60114 WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through = 3.3.1...

CVE-2025-60102

CVE-2025-60102 : Stored Cross-Site Scripting in WPFront User Role Editor for WordPress. Affected software: WPFront User Role Editor, version range up to and including 4.2.3. Root cause and impact: improper neutralization of input during web page generation leading to stored XSS. Public details in...

AZL-68103 CVE-2025-55552 affecting package pytorch for versions less than 2.2.2-9

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randnlike are used together...

git-commiters.js 安全漏洞

git-commiters.js is a js library by Riceball LEE Individual Developers. A security vulnerability exists in git-commiters.js versions prior to 0.1.2, which stems from not cleaning up user input and not securely executing the process API, which could lead to a command injection attack...

CVE-2025-59827 FlagForgeCTF is Missing Authorization in main-v2

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

PT-2025-39348

Name of the Vulnerable Software and Affected Versions Flag Forge versions prior to 2.2.0 Description The /api/admin/assign-badge endpoint in Flag Forge does not have sufficient access controls. This allows any authenticated user to assign high-privilege badges, such as Staff, to themselves. This...

CVE-2025-10147 Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'moveasoriginalfile' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

PT-2025-39211

Name of the Vulnerable Software and Affected Versions Shenzhen C-Data Technology Co. FD602GW-DX-R410 firmware version 2.2.14 Description The web management interface contains an authenticated Cross-Site Request Forgery CSRF issue on the reboot endpoint /boaform/admin/formReboot. An attacker can...

CVE-2025-58962

Server-Side Request Forgery SSRF vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through = 2.2.1...

CVE-2025-58266

CVE-2025-58266 affects the WordPress Gianism plugin up to version 5.2.2, where improper input neutralization during web page generation enables stored XSS. The issue is confirmed across multiple sources in the connected documents, which describe the vulnerability as a Cross-Site Scripting flaw in...

Security Bulletin: Vulnerability in Babel affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Babel has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

WordPress plugin E-namad & Shamed Logo Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-10718 Ooma Office Business Phone App com.ooma.office2 improper export of android application components

A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made...

Regex DoS in Zabbix Plugin in Grafana

Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via...