PT-2025-40470

Name of the Vulnerable Software and Affected Versions The Ultimate Viral Quiz plugin for WordPress versions prior to 1.0 Description The Ultimate Viral Quiz plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation within the save options function. This...

WordPress plugin The Ultimate Viral Quiz 跨站请求伪造漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an applicatio...

CVE-2025-59744

Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”...

CVE-2025-9762

The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the saveattachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2025-8116 Reflected XSS in PAD CMS

PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life a...

WordPress plugin Post By Email Operating System Command Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based...

Polska Akademia Dostępności CMS 跨站脚本漏洞

Polska Akademia Dostępności CMS is an accessible web content management system from Polska Akademia Dostępności, Poland. A cross-site scripting vulnerability exists in Polska Akademia Dostępności CMS, which stems from the Print and Save as PDF functionality being susceptible to a reflective...

CVE-2025-11068

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made publ...

Medium: redis6

Issue Overview: TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen"w" on the history path and subsequent chmod on the same path. CVE-2025-9810 Affected Packages: redis6 Issue Correction: Run dnf...

CVE-2025-11123

A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /goform/saveAutoQos. This manipulation of the argument enable causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2025-11123

The CVE-2025-11123 entry concerns Tenda AC18 firmware 15.03.05.19. Affected component: the /goform/saveAutoQos function; root cause is manipulation of the enable parameter causing a stack-based buffer overflow. Impact is high across confidentiality, integrity, and availability, with remote (netwo...

CVE-2025-9899

The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the feedsave function. This makes it possible for...

PT-2025-39794

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.19 Description A flaw exists in Tenda AC18 version 15.03.05.19. The issue involves a stack-based buffer overflow in an unknown function of the file /goform/saveAutoQos. The enable argument can be manipulated to...

CVE-2025-11069 westboy CicadasCMS Add Department save cross site scripting

A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotel...

CVE-2025-11069 westboy CicadasCMS Add Department save cross site scripting

A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotel...

CVE-2025-11069

CVE-2025-11069 (westboy CicadasCMS 1.0) affects the Add Department Handler: the vulnerability arises from manipulating the Name argument in the file /system/org/save, enabling cross-site scripting. The issue is exploitable remotely and, per multiple sources, the exploit has been publicly disclose...

CVE-2025-11068 westboy CicadasCMS save cross site scripting

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made publ...

CVE-2025-11068

The CVE-2025-11068 entry affects westboy CicadasCMS 1.0, with the vulnerability located in the unknown functionality of /system/cms/category/save. The manipulation of the categoryName parameter results in cross-site scripting (XSS) that can be exploited remotely. Public exploit material exists, i...

CVE-2025-11068 westboy CicadasCMS save cross site scripting

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made publ...

CVE-2025-11062

A vulnerability was determined in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/savestudent.php. Executing manipulation of the argument classid can lead to sql injection. The attack may be performed from remote. The exploit has been...