CVE-2025-5760 Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-5760

CVE-2025-5760 (WordPress Simple History plugin) exposes passwords via logs when Detective Mode is on. In affected versions prior to 5.8.1, append_debug_info_to_context() sanitization is insufficient, causing the plugin to log entire $_POST (and sometimes raw request bodies or $_GET) including pas...

CVE-2025-5760 Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

PT-2025-24077 · WordPress · Simple History

Name of the Vulnerable Software and Affected Versions: The Simple History plugin for WordPress versions prior to 5.8.1 Description: The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context function when Detective Mode is enabled. This allows...

Exploit for External Control of File Name or Path in Themewinter Eventin

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File R...

WordPress Modern Events Calendar Lite plugin <= 7.21.9 - Information Exposure vulnerability

Information Exposure vulnerability discovered by Abdullah Shittu in WordPress Plugin Modern Events Calendar Lite versions = 7.21.9...

Sensitive Data Exposure

django-helpdesk is vulnerable to Sensitive Data Exposure. The vulnerability is due to insecure file permission settings due to os.umask0 in models.py, allows an attacker to access sensitive files or data that should be protected...

Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Summary Static imports are exempted from the network permission check. An attacker could exploit this to leak the password file on the network. Details Static imports in Deno are exempted from the network permission check. This can be exploited by attackers in multiple ways, when third-party code...

WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Sensitive Data Exposure via Log Exposure vulnerability

Sensitive Data Exposure via Log Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin Crawlomatic Multisite Scraper Post Generator versions = 2.6.8.2...

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Summary The Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impression that variables listed in the option are impossible to read. PoC export...

CVE-2025-5036

A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by LVT-tholv2k in WordPress Plugin MultiVendorX versions = 4.2.22...

WordPress elfsight Contact Form widget plugin <= 2.3.1 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin elfsight Contact Form widget versions = 2.3.1...

PT-2025-23841 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 2.1.13 and prior to 2.2.13 Description: The issue affects Deno, a JavaScript, TypeScript, and WebAssembly runtime. It involves the Deno.env.toObject method, which ignores variables listed in the --deny-env option of the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the tarfile extraction process when using the filter parameter set to "data" or "tar". An attacker can write files outside the intended extraction directory by convincing a privileged user or process to extract a...

The vulnerability of the Next.js software platform for creating web applications lies in the insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform is related to the transfer of the x-middleware-subrequest-id parameter to external hosts. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of Apple Maps’ mapping service in macOS operating systems allows a intruder to gain unauthorized access to protected information.

The vulnerability of Apple Maps’ mapping service in macOS operating systems is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

WordPress Broken Link Checker plugin <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View vulnerability

Missing Autorization to Authenticated Subscriber+ Plugin Status Dashboard View vulnerability discovered by Nguyễn Trung Kiên in WordPress Plugin Broken Link Checker versions = 2.4.4...

CVE-2025-5036

A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...