25746 matches found
CVE-2025-7835
The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due to missing or incorrect nonce validation on the 'ithoughtsaceupdateoptions' AJAX action. This makes it possible for unauthenticated attacke...
CVE-2025-7835 iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due to missing or incorrect nonce validation on the 'ithoughtsaceupdateoptions' AJAX action. This makes it possible for unauthenticated attacke...
CVE-2024-53287
Synology Router Manager (SRM) is affected by CVE-2024-53287: an XSS in the VPN Setting functionality where improper input neutralization during web page generation allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. Affec...
PT-2025-30520 · Synology · Synology Router Manager
Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-11 Description: A cross-site scripting XSS issue exists in the VPN Setting functionality. This allows remote authenticated users with administrator privileges to inject arbitrary web...
WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Settings Change vulnerability
WordPress LoginWP - Pro Plugin = 4.0.8.5 - Settings Change vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin LoginWP - Pro versions = 4.0.8.5...
CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authenticati...
NodeJS version of the HAX CMS application is distributed with Default Secrets
Summary The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no...
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
Summary The NodeJS version of HAX CMS uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. Details If a user were to deploy haxcms-nodejs without modifying the default settings,...
CVE-2025-7933
A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/settingsupdate.php of the component Setting Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated...
CVE-2025-7933 Campcodes Sales and Inventory System Setting settings_update.php sql injection
A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/settingsupdate.php of the component Setting Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated...
CVE-2025-30192
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter...
CVE-2025-30192
CVE-2025-30192 affects PowerDNS Recursor: an attacker spoofing answers to ECS-enabled queries can succeed more easily than for non-ECS queries. The updated release/file notes describe mitigations that harden spoofing resistance by chaining ECS-enabled requests and enforcing stricter validation of...
Exploit for Deserialization of Untrusted Data in Microsoft
ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect an...
CampCodes Sales and Inventory System 注入漏洞
CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. An injection vulnerability exists in CampCodes Sales and Inventory System version 1.0, which stems from a SQL injection attack due to a mishandling of the parameter ID in the file /pages/settingsupdate.php...
CVE-2025-7898
A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSetting of the component Account Setting Page. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate...
CVE-2025-7898
A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSetting of the component Account Setting Page. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate...
CVE-2025-6719
The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
PT-2025-30205 · Codecanyon · Identsoft
Name of the Vulnerable Software and Affected Versions: Codecanyon iDentSoft version 2.0 Description: A critical issue exists in Codecanyon iDentSoft 2.0, specifically within the Account Setting Page. The vulnerability allows for unrestricted file upload through manipulation of the photo argument ...
CVE-2025-5344
Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and wallpaper image. This issue affects a...