33092 matches found
WordPress Simple Page Access Restriction Plugin <= 1.0.32 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Simple Page Access Restriction versions = 1.0.32...
WordPress AfterShip Tracking Plugin <= 1.17.17 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin AfterShip Tracking versions = 1.17.17...
WordPress UiCore Elements Plugin <= 1.3.4 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Abu Hurayra in WordPress Plugin UiCore Elements versions = 1.3.4...
WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin WP Bulk Delete versions = 1.3.6...
Exploits and vulnerabilities in Q2 2025
Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published impact the security of nearly every computer subsystem: UEFI, drivers, operating systems, browsers, as well as user and web applications. Based on our analysis, threat actors continue to leverag...
WordPress Printeers Print & Ship plugin <= 1.17.0 - Directory Traversal vulnerability
Directory Traversal vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Printeers Print & Ship versions = 1.17.0...
WordPress ArcHub Theme <= 1.2.12 is vulnerable to Broken Access Control
Software ArcHub Type Theme Vulnerable versions = 1.2.12 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Access Control CVE CVE-2025-0951 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID deda1a0a86d7 Credits Lucio Sá Required...
WordPress Makeaholic Theme <= 1.8.5 is vulnerable to Broken Access Control
Software Makeaholic Type Theme Vulnerable versions = 1.8.5 Fixed in 1.8.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID de9323d56155 Credits Tran Nguyen Bao Khanh VCI - VNPT...
Linux Distros Unpatched Vulnerability : CVE-2021-39902
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. CVE-2021-39902 Not...
WordPress Pin WP Theme < 7.2 is vulnerable to Arbitrary File Upload
Software Pin WP Type Theme Vulnerable versions 7.2 Fixed in 7.2 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-53251 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 85f8a3209836 Credits Bonds Required privilege Subscriber Published 27 August...
SUSE: Security Advisory (SUSE-SU-2025:02973-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
WordPress Lazy Load for Videos plugin <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability discovered by Webbernaut in WordPress Plugin Lazy Load for Videos versions = 2.18.7...
WordPress All-in-One WP Migration and Backup plugin <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting via Import vulnerability discovered by Jack Pas Dark. in WordPress Plugin All-in-One WP Migration versions = 7.97...
WordPress SiteSEO plugin <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Broken Regex Expression vulnerability discovered by stealthcopter in WordPress Plugin SiteSEO versions = 1.2.7...
CVE-2025-9478
CVE-2025-9478 : Use-after-free in ANGLE within Google Chrome prior to 139.0.7258.154 can enable a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE/Chromium WebKit stack used by Chrome. Impact per sources: potential arbitrary code execution, heap corrupti...
Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues in IBM Semeru Runtime version 17
Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-50059 DESCRIPTION: Vulnerability in the Oracle Ja...
CVE-2025-52037
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of...
CVE-2025-52036
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as o...
WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Drag and Drop File Upload for Elementor Forms versions = 1.5.3...