CVE-2025-64046

OpenRapid RapidCMS version 1.3.1 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability exists specifically in the /system/update-run.php API endpoint, which allows for the injection of malicious scripts. To remediate this...

VulnCheck KEV: CVE-2020-25213

The File Manager wp-file-manager plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload or mkfile and p...