Advisory ROSA-SA-2025-2967

Software: avahi 0.7 OS: ROSA Virtualization 2.1 unaffected versions = avahi-0.7-27.0.2.rv3.1 affected versions avahi-0.7-27.0.2.2.rv3.1 CVE-ID: CVE-2018-1000845 BDU-ID: 2019-00693 CVE-Crit: CRITICAL. CVE-DESC: Duplicate CVE-2017-6519 CVE-STATUS: The vulnerability has been resolved CVE-REV: To clo...

Advisory ROSA-SA-2025-2965

Software: avahi 0.7 OS: ROSA Virtualization 3.0 unaffected versions = avahi-0.7-27.0.2.rv30.1 affected versions avahi-0.7-27.0.0.2.rv30.1 CVE-ID: CVE-2017-6519 BDU-ID: 2019-00693 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the avahi-daemon daemon of the Avahi local area network service...

Advisory ROSA-SA-2025-2958

Software: xmlrpc-c 1.51.0 OS: ROSA Virtualization 2.1 unaffected versions = xmlrpc-c-1.51.0-11.0.1.rv3 affected versions xmlrpc-c-1.51.0-11.0.1.rv3 CVE-ID: CVE-2024-8176 BDU-ID: 2025-04573 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libexpat XML file parsing library is related to a stack-bas...

Advisory ROSA-SA-2025-2959

Software: avahi 0.7 OS: ROSA Virtualization 2.1 unaffected versions = avahi-0.7-27.0.2.rv3.1 affected versions avahi-0.7-27.0.2.2.rv3.1 CVE-ID: CVE-2017-6519 BDU-ID: 2019-00693 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the avahi-daemon daemon of the Avahi local area network service...

📄 Rupee Invoice 1.0 SQL Injection

Rupee Invoice version 1.0 suffers from a remote SQL injection vulnerability. Titles: RUPEE-INVOICE-1.0-Multiple-SQLi Author: nu11secur1ty Date: 09/09/2025 Vendor: https://www.mayurik.com/ Software:...

WordPress AutomatorWP plugin <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation vulnerability

Missing Authorization To Authenticated Subscriber+ Remote Code Execution via Automation Creation vulnerability discovered by stealthcopter in WordPress Plugin AutomatorWP versions = 5.3.6...

WordPress WP-Members Membership Plugin plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via Profile Names vulnerability discovered by Kishan Vyas in WordPress Plugin WP-Members versions = 3.5.4.2...

WordPress Tantra Theme <= 2.1.0 is vulnerable to Local File Inclusion

Software Tantra Type Theme Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 37cc376eca77 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Juno Theme <= 2.19 is vulnerable to Local File Inclusion

Software Juno Type Theme Vulnerable versions = 2.19 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1d4e77af675c Credits Bonds Required privilege Unauthenticated Published 8...

WordPress Kargo Theme <= 1.1.13 is vulnerable to Local File Inclusion

Software Kargo Type Theme Vulnerable versions = 1.1.13 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 31c938be3ceb Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress HotLock Theme <= 1.3.9 is vulnerable to Local File Inclusion

Software HotLock Type Theme Vulnerable versions = 1.3.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 457feca0b67b Credits Bonds Required privilege Unauthenticated Published ...

WordPress PathWell Theme <= 1.1.16 is vulnerable to Local File Inclusion

Software PathWell Type Theme Vulnerable versions = 1.1.16 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 48d7c14445e6 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress AlphaColor Theme <= 1.4.11.1 is vulnerable to Local File Inclusion

Software AlphaColor Type Theme Vulnerable versions = 1.4.11.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 64fc4d9d2990 Credits Bonds Required privilege Unauthenticated...

WordPress Travesia Theme <= 1.1.15 is vulnerable to Local File Inclusion

Software Travesia Type Theme Vulnerable versions = 1.1.15 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 68dec7b64a09 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Insurance Ancora Theme <= 2.10.0 is vulnerable to Local File Inclusion

Software Insurance Ancora Type Theme Vulnerable versions = 2.10.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1ab0620efd72 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

WordPress Anesta Theme <= 1.2.1 is vulnerable to Local File Inclusion

Software Anesta Type Theme Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID f2fff1320acd Credits Bonds Required privilege Unauthenticated Published 8...

WordPress Let's Play Theme <= 1.1.14 is vulnerable to Local File Inclusion

Software Let's Play Type Theme Vulnerable versions = 1.1.14 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 559adde23e67 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress StevenWatkins Theme <= 2.4.0 is vulnerable to Local File Inclusion

Software StevenWatkins Type Theme Vulnerable versions = 2.4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID f134ae972b7e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immuni...

WordPress Goza Theme <= 3.2.2 is vulnerable to Arbitrary File Upload

Software Goza Type Theme Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-5394 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 66a283dd0c55 Credits GR0V Required privilege Unauthenticated Published 8...

WordPress Chakra Theme <= 1.13.0 is vulnerable to Local File Inclusion

Software Chakra Type Theme Vulnerable versions = 1.13.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 45c32e9a60a9 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...