WordPress Easy Elements Hider plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Ryan Novotny in WordPress Plugin Easy Elements Hider versions = 2.0...

WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by greenhats in WordPress Plugin Bulk Featured Image versions = 1.2.4...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2025-49867 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9303a55298f9 Credits Frank Required privilege...

WordPress Accept Stripe Payments Using Contact Form 7 plugin <= 3.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by astra.r3verii in WordPress Plugin Accept Stripe Payments Using Contact Form 7 versions = 3.0...

Vulnerability of the smsc75xx_bind() function in the drivers/net/usb/smsc75xx.c module – The driver for supporting USB network adapters in Linux kernels allows a hacker to gain access to protected information.

Vulnerability of the smsc75xxbind function in the drivers/net/usb/smsc75xx.c module – The Linux USB network adapter driver has vulnerabilities related to security configuration errors. Exploiting this vulnerability can allow attackers to gain access to protected information...

Vulnerability of the mcba_usb_start() function in the drivers/net/can/usb/mcba_usb.c module – The Linux kernel’s CAN network device support driver allows a hacker to cause a service failure.

Vulnerability of the mcbausbstart function in the drivers/net/can/usb/mcbausb.c module – The Linux kernel’s CAN network device driver has vulnerabilities related to security configuration errors. Exploiting this vulnerability could allow an attacker to cause service failures...

WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability

Full Path Disclosure FPD Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.5.2...

WordPress plugin CubeWP Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An authorization issue vulnerability exists in the WordPress CubeWP Forms plugin that stems from a lack of authorization and can be exploited by an attacker to configure incorre...

CVE-2025-42998

The CVE-2025-42998 entry concerns SAP Business One Integration Framework. Reported issue: access control checks are insufficient, enabling an attacker to bypass 403 Forbidden restrictions and access restricted pages. Impact is described as low confidentiality impact with no stated effects on inte...

CVE-2025-42998 Security misconfiguration vulnerability in SAP Business One Integration Framework

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability...

CVE-2025-42998 Security misconfiguration vulnerability in SAP Business One Integration Framework

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability...

Vulnerability of the mt7915_unregister_device() function in the drivers/net/wireless/mediatek/mt76/mt7915/init.c file – This driver is part of the Linux kernel’s wireless adapter support mechanism; it allows a hacker to cause a service failure.

Vulnerability of the mt7915unregisterdevice function in the drivers/net/wireless/mediatek/mt76/mt7915/init.c module – The Linux kernel’s wireless adapter support driver has vulnerabilities related to security configuration errors. Exploiting this vulnerability could allow an attacker to cause...

CVE-2025-30974

Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Grid Master: from n/a through 3.4.13...

WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by LVT-tholv2k in WordPress Plugin MultiVendorX versions = 4.2.22...

WordPress elfsight Contact Form widget plugin <= 2.3.1 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin elfsight Contact Form widget versions = 2.3.1...

CVE-2024-9160

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-21703

This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitiv...

CVE-2024-6336

A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a depende...

CVE-2023-22920

A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00ABMP.6C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet...

CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the...