Exploit for CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Unauthenticated Subscr...

CVE-2025-4601

The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiryupdateprofile function. This makes it possible for...

observability Operator 安全漏洞

observability Operator is a Red Hat Observability open source software for creating required monitoring stacks on Kubernetes clusters. A security vulnerability exists in observability Operator that stems from the creation of a ServiceAccount with a ClusterRole, which could lead to elevated...

PT-2025-25356 · Unknown · Yangyouwang Crud

Name of the Vulnerable Software and Affected Versions: yangyouwang crud version 1.0.0 Description: The issue is related to Cross Site Scripting XSS via the role management function. Recommendations: For version 1.0.0, as a temporary workaround, consider restricting access to the role management...

CVE-2025-44091

yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting XSS via the role management function...

CVE-2025-44091

yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting XSS via the role management function...

crud 安全漏洞

crud is a minimalist backend management system by the individual developer Yang Youwang yangyouwang，in China. A security vulnerability exists in yangyouwang crud version 1.0.0, which stems from the role management feature being vulnerable to cross-site scripting attacks...

CVE-2025-44091

The CVE-2025-44091 entry documents a Cross Site Scripting (XSS) vulnerability in yangyouwang crud v1.0.0, exploitable via the role management function. Affected software/component: yangyouwang crud (v1.0.0). Root cause details are not fully disclosed in the provided materials, but multiple source...

CVE-2025-47849

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and...

CVE-2025-47849

CVE-2025-47849 (Apache CloudStack) : Privilege escalation affects CloudStack versions 4.10.0.0 through 4.20.0.0. A malicious Domain Admin in the ROOT domain can obtain the API key and secret key of Admin-role accounts in the same domain, enabling impersonation and access to sensitive APIs and res...

CVE-2025-47713

Apache CloudStack

CVE-2025-4601

The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiryupdateprofile function. This makes it possible for...

CVE-2025-4601

The CVE-2025-4601 entry applies to RH - Real Estate WordPress Theme (RealHomes). A privilege-escalation vulnerability exists in versions

WordPress plugin RH - Real Estate WordPress Theme Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Siemens SCALANCE and RUGGEDCOM

SUMMARY Several Industrial Communication Devices based on SINEC OS before V3.1 contain an incorrect authorization check vulnerability that could allow an attacker to perform actions that exceed the permissions of the "guest" role. Siemens has released new versions for the affected products and...

Data-Driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source Npm Packages

The npm Node Package Manager ecosystem is the most important package manager for JavaScript development with millions of users. Consequently, a plethora of earlier work investigated how vulnerability reporting, patch propagation, and in general detection as well as resolution of security issues i...

Exploit for CVE-2025-5701

CVE-2025-5701 - Unauthenticated Privilege Escalation Exploit...

CVE-2025-4567

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...

GO-2025-3734 Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome

Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome...

CVE-2025-4567 Post Slider and Carousel with Widget < 3.2.10 - Admin+ Stored XSS

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...