CVE-2025-5928

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-5930

The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request...

CVE-2025-5928 WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-5930 WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update

The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request...

[SECURITY] Fedora 41 Update: valkey-8.0.3-3.fc41

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

PT-2025-25399 · WordPress · Auto Attachments

Name of the Vulnerable Software and Affected Versions: Auto Attachments plugin for WordPress versions up to, and including, 1.8.5 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-25380 · WordPress · Telegram For Wp

Name of the Vulnerable Software and Affected Versions: Telegram for WP plugin for WordPress versions up to, and including, 1.6.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticate...

PT-2025-25377 · WordPress · Wp Sliding Login/Dashboard Panel

Name of the Vulnerable Software and Affected Versions: WP Sliding Login/Dashboard Panel plugin versions up to, and including, 2.1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wp sliding panel user options function. This allo...

CVE-2025-49184

A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product...

CVE-2025-49184 Information disclosure to unauthorized user

A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product...

CVE-2025-49184 Information disclosure to unauthorized user

A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product...

CVE-2025-49184

CVE-2025-49184 describes an information-disclosure issue caused by missing authorization for configuration settings, enabling a remote attacker to gather sensitive application data. Connected sources reference SICK Field Analytics and SICK Media Server as affected products and reiterate the unaut...

CVE-2025-43701

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows exposure of Custom Settings data. This impacts OmniStudio: before version 254...

Exploit for CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Unauthenticated Subscr...

CVE-2025-42998

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability...

SICK Field Analytics和SICK Media Server 信息泄露漏洞

SICK Field Analytics and SICK Media Server are both products of SICK GmbH, Germany.SICK Field Analytics is software for evaluating manufacturing data.SICK Media Server is a media server. A security vulnerability exists in SICK Field Analytics and SICK Media Server that stems from a lack of...

PT-2025-25309

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product. Recommendations At the moment, there ...

CVE-2025-3582

The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Traffic Offense Reporting System save-settings.php file cross-site scripting vulnerability

Traffic Offense Reporting System is a traffic violation reporting system. Traffic Offense Reporting System suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data by the sitename parameter in the save-settings.php file...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-1635)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ipv4: Fix a data-race around sysctlfibsyncmem.CVE-2022-49637 ima: Fix potential memory leak in imainitcrypto.CVE-2022-49627 MIPS: pgalloc: fix...