SUSE: Security Advisory (SUSE-SU-2025:1521-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:1503-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:1504-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:1456-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress TheGem Theme <= 5.10.3 is vulnerable to Broken Access Control

Software TheGem Type Theme Vulnerable versions = 5.10.3 Fixed in 5.10.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-4339 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0df3139c7e52 Credits Foxyyy Required privilege Subscriber...

Debian: Security Advisory (DLA-4160-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:1511-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-4514

CVE-2025-4514 applies to Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. The vulnerability affects the file /javascript.php ; modifying the Value parameter enables a SQL injection. The issue can be exploited remotely and an exploit has been disclosed publicly. Connected advisories corr...

Exploit for CVE-2023-50702

Vulnerability Advisory This is a documented notice that provid...

WordPress WordPress Review Plugin plugin <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields vulnerability

Authenticated Contributor+ Local File Inclusion via Post Custom Fields vulnerability discovered by Hiroho Shimada in WordPress Plugin WordPress Review Plugin versions = 5.3.5...

WordPress Ditty plugin < 3.1.52 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ditty versions 3.1.52...

WordPress MailPoet plugin < 5.5.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ingatyev in WordPress Plugin MailPoet versions 5.5.2...

WordPress Jeg Elementor Kit plugin <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Video Button and Countdown Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Jeg Elementor Kit versions = 2.6.12...

WordPress WPForms Lite plugin <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'starttimestamp' Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Contact Form by WPForms versions = 1.9.5...

WordPress Groundhogg plugin <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability

Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by Phat Do in WordPress Plugin Groundhogg versions = 4.1.1.2...

WordPress EUCookieLaw plugin <= 2.7.2 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Nicolai Hellesnes nico in WordPress Plugin EUCookieLaw versions = 2.7.2...

CVE-2025-4487

A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=deletemember. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2025-4485

CVE-2025-4485 affects itsourcecode Gym Management System 1.0. A vulnerable component is the /ajax.php?action=delete_trainer endpoint where manipulating the ID parameter yields an SQL injection. The issue is exploitable remotely and is noted as publicly disclosed. Connected documents confirm the v...

WordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by domiee13 in WordPress Plugin FunnelCockpit versions = 1.4.3...

WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Aiden Thái An in WordPress Plugin StoreKeeper for WooCommerce versions = 14.4.4...