32045 matches found
WordPress WP Hotel Booking plugin < 2.2.3 - Subscriber+ Rating Manipulation vulnerability
Subscriber+ Rating Manipulation vulnerability discovered by Muhammed Çelik in WordPress Plugin WP Hotel Booking versions 2.2.3...
WordPress Ghost Kit plugin <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Ghost Kit versions = 3.4.3...
WordPress Chained Quiz plugin <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie vulnerability
Unauthenticated Insecure Direct Object Reference via Cookie vulnerability discovered by Karuppiah Sabari Kumar in WordPress Plugin Chained Quiz versions = 1.3.5...
esm.sh has File Inclusion issue
Summary A Local File Inclusion LFI issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem or other unintended file sources. Severity: High — LFI can expose secrets, configuration files,...
WordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Quantities and Units for WooCommerce versions = 1.0.13...
WordPress StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download vulnerability
Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by Ryan Kozak in WordPress Plugin StoreEngine versions = 1.5.0...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 4 security fixes: 445380761 High CVE-2025-10585: Type Confusion in V8. Reported by Google Threat Analysis Group on 2025-09-16 435875050 High CVE-2025-10500: Use after free in Dawn. Reported by Giunash Gyujeong Jin on 2025-08-03 440737137 High...
WordPress Blocksy Companion plugin <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via blocksynewslettersubscribe Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Blocksy Companion versions = 2.1.10...
WordPress The Hack Repair Guy's Plugin Archiver plugin <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content vulnerability
Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin The Hack Repair Guy's Plugin Archiver versions = 2.0.4...
WordPress Appointmind plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Appointmind versions = 4.1.0...
WordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Wide Banner versions = 1.0.4...
GitHub's Copilot Code Review: Can AI Spot Security Flaws Before You Commit?
As software development practices increasingly adopt AI-powered tools, ensuring that such tools can support secure coding has become critical. This study evaluates the effectiveness of GitHub Copilot's recently introduced code review feature in detecting security vulnerabilities. Using a curated...
📄 namrb.bg SQL Injection
namrb.bg suffers from a remote SQL injection vulnerability. The owner of the site has been unresponsive to the researcher so this is being posted to encourage them to address their issues for the safety of their users. Titles: namrb.bg app-Multiple-SQLi Author: nu11secur1ty Date: 09/15/2025 Vendo...
Fedora 43 : exiv2 (2025-c23727e694)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c23727e694 advisory. Exiv2 0.28.6 + patch to fix silent abi breakage ---- Exiv2 v0.28.6 Fixes two low severity CVEs Tenable has extracted the preceding description block...
WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Falang multilanguage versions = 1.3.65...
WordPress Contact Form 7 reCAPTCHA plugin <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI'] vulnerability
Reflected XSS via $SERVER'REQUESTURI' vulnerability discovered by Bob Matyas in WordPress Plugin Contact Form 7 reCAPTCHA versions = 1.2.0...
CVE-2025-10200
Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...
WordPress WP Mailgun SMTP Plugin <= 1.0.7 - Sensitive Data Exposure Vulnerability
Sensitive Data Exposure Vulnerability discovered by Legion Hunter in WordPress Plugin WP Mailgun SMTP versions = 1.0.7...
WordPress WP SendGrid SMTP Plugin <= 1.0.6 - Sensitive Data Exposure Vulnerability
Sensitive Data Exposure Vulnerability discovered by Legion Hunter in WordPress Plugin WP SendGrid SMTP versions = 1.0.6...
