CVE-2025-49845: Exposure of Sensitive Information to an Unauthorized Actor

Discourse is an open-source discussion platform. The visibility of posts typed whisper is controlled via the whispersallowedgroups site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed whisper. However, it has been discovered that users of...

GHSA-VWPQ-WM8W-44WF

creationtimestamp| type| source ---|---|--- 2025-06-24 20:47:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19403 2025-06-30 20:17:18+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114774156067822141 2025-06-30 20:28:20+00:00| seen|...

CERTFR-2025-ACT-026

creationtimestamp| type| source ---|---|--- 2025-06-23 12:20:29+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lsbkyfpb4524 2025-06-23 12:20:33+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114732644952742769...

Truth Social Crashes as Trump Live-Posts Iran Bombing

The social network started experiencing global outages within minutes of Donald Trump posting details of a US military strike on Iran...

CVE-2025-5143: Improper Neutralization of Input During Web Page Generation

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableonpopupiframebutton shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2025-52802

CVE-2025-52802 describes a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin “Import YouTube videos as WP Posts” (versions n/a–2.1). The issue arises from incorrectly configured access control, enabling unauthorized actions that affect WP Posts created via the pl...

WordPress plugin Import YouTube videos as WP Posts 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2025-52802: Missing Authorization

Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through = 2.1...

CVE-2025-49132

creationtimestamp| type| source ---|---|--- 2025-06-19 16:52:25+00:00| seen| https://bsky.app/profile/ryan.staticnoi.se/post/3lrxycwhe7s2g 2025-06-19 16:52:25+00:00| seen| https://bsky.app/profile/ryan.staticnoi.se/post/3lrxycurark2g 2025-06-20 02:20:35+00:00| seen|...

CVE-2025-24286

creationtimestamp| type| source ---|---|--- 2025-06-18 12:04:07+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus12/2025 2025-06-18 23:41:34+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18821 2025-06-19 01:05:08+00:00| seen|...

CVE-2025-6019

creationtimestamp| type| source ---|---|--- 2025-06-17 18:03:49+00:00| seen| https://seclists.org/oss-sec/2025/q2/261 2025-06-17 18:09:42+00:00| seen| https://seclists.org/oss-sec/2025/q2/262 2025-06-17 18:29:48+00:00| seen| https://seclists.org/oss-sec/2025/q2/263 2025-06-17 20:38:28+00:00| seen...

PYSEC-2025-236

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting XSS vulnerability in the admin interface. The vulnerability exists in the "displayablelinksjs" function, which fails to properly sanitize blog post titles before including them in JSON responses served via...

CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting XSS vulnerability in the admin interface. The vulnerability exists in the "displayablelinksjs" function, which fails to properly sanitize blog post titles before including them in JSON responses served via...

WordPress flexo-posts-manager Plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Dinh Tuan BlueRock in WordPress Plugin flexo-posts-manager versions = 1.0001...

CVE-2025-5943

creationtimestamp| type| source ---|---|--- 2025-06-10 18:33:21+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17964 2025-06-10 19:56:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrbogcu6d72p 2025-06-10 20:05:26+00:00| seen|...

CVE-2025-28966

Cross-Site Request Forgery CSRF vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through = 1.0.1...

CVE-2025-39358

Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through = 1.3.12...

CVE-2025-28966

Cross-Site Request Forgery CSRF vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through = 1.0.1...

CVE-2025-28966 WordPress Recent Posts Slider Responsive plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through = 1.0.1...

CVE-2025-28966 WordPress Recent Posts Slider Responsive plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through = 1.0.1...