CVE-2025-39453

CVE-2025-39453: CSRF in Advanced Dynamic Pricing for WooCommerce (algol.plus) affects versions n/a through 4.9.3. Root cause is Cross-Site Request Forgery enabling unauthorized actions when a logged-in user interacts with the vulnerable plugin. Impact is limited to integrity/availability as per s...

CVE-2025-39453 WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.9.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Site Request Forgery.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through = 4.9.3...

CVE-2025-1525

CVE-2025-1525 affects the WordPress plugin Ultimate Dashboard (before 3.8.6). Multiple connected sources confirm that insufficient sanitization/escaping of plugin settings enables Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (e.g., multisite). The pat...

CVE-2025-29280

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code...

CVE-2025-29453

CVE-2025-29453 affects Personal Management System 1.4.65, specifically the my-contacts-settings component. The description indicates a vulnerability that could allow a remote attacker to obtain sensitive information. The connected PT- and vendor-referenced sources reiterate the same impact but do...

TwoNav 安全漏洞

TwoNav is an open source and free bookmark navigation management program from tznb1 open source. A security vulnerability exists in TwoNav version 2.1.18-20241105, which stems from mishandling of the site settings component and could allow a remote attacker to obtain sensitive information...

WordPress plugin Ultimate Dashboard 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2025-16937 · WordPress · The Ultimate Dashboard

Name of the Vulnerable Software and Affected Versions: The Ultimate Dashboard WordPress plugin versions prior to 3.8.6 Description: The issue concerns a Stored Cross-Site Scripting vulnerability. It arises because the plugin does not properly sanitise and escape some of its settings, allowing...

CVE-2025-29450

An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component...

PT-2025-17232 · Twonav · Twonav

Name of the Vulnerable Software and Affected Versions: twonav version 2.1.18-20241105 Description: The issue allows a remote attacker to obtain sensitive information via the site settings component. Recommendations: For twonav version 2.1.18-20241105, consider restricting access to the site...

CVE-2025-29453

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings component...

Seo Panel 安全漏洞

Seo Panel is a free search engine optimization software from Seo Panel Open Source. A security vulnerability exists in Seo Panel version 4.11.0, which stems from mishandling of the email settings component and could allow a remote attacker to obtain sensitive information...

Personal Management System 安全漏洞

Personal Management System is a web application for managing personal data by Dariusz Personal Developer. A security vulnerability exists in Personal Management System version 1.4.65, which stems from mishandling of the my-contacts-settings component and could allow a remote attacker to obtain...

CVE-2025-32863

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UnlockTraceLevelSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read...

CVE-2025-32859

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'LockWebServerGatewaySettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to...

CVE-2025-32857

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UnlockBufferingSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read...

CVE-2025-32855

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UnlockOpcSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from a...

CVE-2025-32854

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'LockOpcSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and...

CVE-2025-32852

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'LockDatabaseSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read fro...

CVE-2025-31353

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UpdateOpcSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from a...