WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bao - BlueRock in WordPress Plugin Export WP Page to Static HTML/CSS versions = 4.1.0...

CVE-2025-54251

Affected product : Adobe Experience Manager (AEM) ≤ 6.5.23.0. Vulnerability type : XML Injection that can bypass security features. Root cause / vector : Unspecified in the CVE entry, but the Nuclei template and related notes describe an XML injection that allows manipulation of XML queries and c...

CVE-2025-39553 WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in andymoyle Church Admin. This issue affects Church Admin: from n/a through 5.0.9...

CVE-2025-39553

CVE-2025-39553 (Church Admin plugin) details : A Missing Authorization vulnerability affects WordPress Church Admin instances using versions from unknown up to 5.0.9. The CVE entry indicates potential unauthorized access leading to data exposure (the vulnerability is categorized as Missing Author...

CVE-2025-9994

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access...

CVE-2025-9994

The Amp’ed RF BT-AP 111 Bluetooth access point exposes an HTTP admin interface that has no authentication. This allows any user with network access to gain full administrative control of the device. Current public details do not indicate a fixed version; some sources note no fix is available yet....

CVE-2025-9994 Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access...

CVE-2025-10095

CVE-2025-10095 affects the SMSEagle firmware in the SMPP server component. The issue arises from improper sanitization of user input in the SMPP server scripts during database interactions, and is limited to the SMPP server’s dedicated database. The vulnerability’s impact is described as a SQL in...

CVE-2025-40795

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, User Management Component UMC All versions V2.15.1.3. Affected products contain a stack-based buffer overflow vulnerability in the...

CVE-2025-40798

CVE-2025-40798 affects Siemens SIMATIC PCS neo versions 4.1, 5.0, 6.0 (all versions) and the embedded User Management Component (UMC) versions prior to 2.15.1.3. The vulnerability is an out-of-bounds read in the UMC that could allow an unauthenticated remote attacker to cause a denial of service....

CVE-2025-40797

CVE-2025-40797 affects Siemens SIMATIC PCS neo and its User Management Component (UMC). The UMC contains an out-of-bounds read vulnerability that can be triggered by an unauthenticated remote attacker, causing a denial of service. Affected products include PCS neo v4.1, v5.0, and v6.0 (all versio...

CVE-2025-40795

The CVE-2025-40795 issue affects Siemens SIMATIC PCS neo versions 4.1, 5.0 and 6.0, and the integrated User Management Component (UMC)

CVE-2025-40795

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, User Management Component UMC All versions V2.15.1.3. Affected products contain a stack-based buffer overflow vulnerability in the...

CVE-2025-42914

Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiali...

CVE-2025-10065

A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unittesting/templates/domdatath.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be...

CVE-2025-10114 PHPGurukul Small CRM profile.php sql injection

A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used...

POS Point of Sale System /2512.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...

PT-2025-36732

Name of the Vulnerable Software and Affected Versions: Amp’ed RF BT-AP 111 Bluetooth access point affected versions not specified Description: The HTTP admin interface lacks an authentication feature, enabling unauthorized access to individuals with network access. Recommendations: At the moment,...

PT-2025-36550

Name of the Vulnerable Software and Affected Versions: SAP HCM Approve Timesheets Fiori 2.0 application affected versions not specified Description: The SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, leading to privilege...

PT-2025-36959

Name of the Vulnerable Software and Affected Versions: Halo versions prior to v2.20.17 Description: Halo is susceptible to a Cross Site Scripting XSS issue in the /halo host/archives/name API endpoint. The vulnerability resides in the handling of the name parameter, allowing for potential script...