CVE-2025-8811

A vulnerability, which was classified as critical, has been found in code-projects Simple Art Gallery 1.0. Affected by this issue is some unknown functionality of the file /Admin/registration.php. The manipulation of the argument fname leads to sql injection. The attack may be launched remotely...

WordPress School Management Plugin <= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin School Management versions = 1.93.1 02-07-2025...

WordPress WP Dynamic Links plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin WP Dynamic Links versions = 1.0.1...

WordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin WP Voting versions = 1.8...

Microsoft Releases Guidance on High-Severity Vulnerability (CVE-2025-53786) in Hybrid Exchange Deployments

Update 08/12/2025: CISA has updated this alert to provide clarification on identifying Exchange Servers on an organization’s networks and provided further guidance on running the Microsoft Exchange Health Checker. Update 08/07/2025: CISA issued Emergency Directive ED 25-02: Mitigate Microsoft...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

WordPress OceanWP Theme 4.0.9 - 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software OceanWP Type Theme Vulnerable versions 4.0.9 - 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-8891 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1d569e8bf081 Credits Dmitrii Ignatyev Requir...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2025-1935)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2020-11985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IP address spoofing when proxying using modremoteip and modrewrite For configurations using proxying with modremoteip and certain modrewrite rules, an attacker...

WordPress Simple Local Avatars plugin <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration vulnerability

Missing Authorization to Authenticated Subscriber+ Avatar Migration vulnerability discovered by Håkon Harnes in WordPress Plugin Simple Local Avatars versions = 2.8.4...

Security Bulletin: Astronomer with IBM is vulnerable to request smuggling due to the h11 package (CVE-2025-43859).

Summary The h11 package is used by Astronomer with IBM as part of request processing. This addresses the vulnerability. Vulnerability Details CVEID:CVE-2025-43859 DESCRIPTION: h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in...

WordPress Elementor plugin <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import vulnerability

Authenticated Administrator+ Arbitrary File Read via Image Import vulnerability discovered by mikemyers in WordPress Plugin Elementor Website Builder versions = 3.30.2...

WordPress Software Issue Manager plugin <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via noaccessmsg Parameter vulnerability discovered by muhammad yudha in WordPress Plugin Software Issue Manager versions = 5.0.0...

WordPress Mosaic Generator plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'c' Parameter vulnerability discovered by muhammad yudha in WordPress Plugin Mosaic Generator versions = 1.0.5...

WordPress Simple Responsive Slider plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Simple Responsive Slider versions = 2.0...

WordPress Wp chart generator plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpchart Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Wp chart generator versions = 1.0.4...

WordPress Inline Stock Quotes plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via stock Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Inline Stock Quotes versions = 0.2...

WordPress WP Private Content Plus plugin <= 3.6.2 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Luca Epifanio Bitcube Security in WordPress Plugin WP Private Content Plus versions = 3.6.2...

WordPress GMap - Venturit plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter vulnerability

WordPress GMap - Venturit plugin = 1.1 - Authenticated Contributor+ Stored Cross-Site Scripting via 'h' Parameter vulnerability discovered by muhammad yudha in WordPress Plugin GMap Generator versions = 1.1...

WordPress RT Easy Builder plugin <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin RT Easy Builder – Advanced addons for Elementor versions = 2.3...