PT-2025-22121 · Salesforce · Omnis Studio

Name of the Vulnerable Software and Affected Versions: Salesforce OmniStudio versions prior to 254 Description: The issue is related to an Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards, which allows exposure of Custom Settings data. Recommendations: For...

CVE-2025-43838 WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability

Missing Authorization vulnerability in ChoPlugins Custom PC Builder Lite for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommerce: from n/a through 1.0.1...

CVE-2025-48272

Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through = 2.3.2...

CVE-2025-48265

CVE-2025-48265 relates to a CSRF vulnerability in the WordPress plugin Year Make Model Search for WooCommerce (YMM Search for WooCommerce). Affected versions are listed as n/a through 1.0.11. The issue enables Cross-Site Request Forgery for actions affecting the plugin’s settings. Public assets i...

CVE-2025-48265 WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...

CVE-2025-48265 WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...

CVE-2025-48259 WordPress WP Mapa Politico España plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Juan Carlos WP Mapa Politico España allows Cross Site Request Forgery. This issue affects WP Mapa Politico España: from n/a through 3.8.0...

CVE-2025-48259 WordPress WP Mapa Politico España plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Juan Carlos WP Mapa Politico España wp-mapa-politico-spain allows Cross Site Request Forgery.This issue affects WP Mapa Politico España: from n/a through = 3.8.0...

CVE-2025-2561

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-2561

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin Ninja Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-4860

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137ALLen20210528. Affected is an unknown function of the file /advdhcps.php of the component Static Pool Settings Page. The manipulation of the argument fmac leads to cross site scripting. It is possible to launch...

CVE-2025-4859

A vulnerability was found in D-Link DAP-2695 120b36r137ALLen20210528. It has been rated as problematic. This issue affects some unknown processing of the file /advmacbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument fmac leads to cross site scripting. The atta...

CVE-2025-4860 D-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scripting

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137ALLen20210528. Affected is an unknown function of the file /advdhcps.php of the component Static Pool Settings Page. The manipulation of the argument fmac leads to cross site scripting. It is possible to launch...

CVE-2025-4860 D-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scripting

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137ALLen20210528. Affected is an unknown function of the file /advdhcps.php of the component Static Pool Settings Page. The manipulation of the argument fmac leads to cross site scripting. It is possible to launch...

CVE-2025-4860

The CVE-2025-4860 entry concerns D-Link DAP-2695 (Static Pool Settings Page) where an input parameter f_mac in /adv_dhcps.php enables cross-site scripting. Multiple sources confirm a remote exploitation path and that affected devices are no longer maintained by the vendor. Public disclosures exis...

CVE-2025-4859 D-Link DAP-2695 MAC Bypass Settings Page adv_macbypass.php cross site scripting

A vulnerability was found in D-Link DAP-2695 120b36r137ALLen20210528. It has been rated as problematic. This issue affects some unknown processing of the file /advmacbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument fmac leads to cross site scripting. The atta...

CVE-2025-4859

CVE-2025-4859 affects D-Link DAP-2695, specifically the MAC Bypass Settings Page file /adv_macbypass.php where the f_mac parameter can be manipulated to trigger cross-site scripting. Publicly disclosed exploitation exists; the issue arises from insufficient input filtering/escaping, and it may be...

CVE-2025-4859 D-Link DAP-2695 MAC Bypass Settings Page adv_macbypass.php cross site scripting

A vulnerability was found in D-Link DAP-2695 120b36r137ALLen20210528. It has been rated as problematic. This issue affects some unknown processing of the file /advmacbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument fmac leads to cross site scripting. The atta...

PT-2025-21831 · D Link · D-Link Dap-2695

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2695 version 120b36r137 ALL en 20210528 Description: A vulnerability has been found in the Static Pool Settings Page component, specifically in the /adv dhcps.php file. The manipulation of the f mac argument leads to cross-site...