Security Advisory Ivanti Avalanche (CVE-2025-8296, CVE-2025-8297) 

Summary Ivanti has released updates for Ivanti Avalanche which addresses two high severity vulnerabilities. Successful exploitation could lead to authenticated remote code execution. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerabilit...

CVE-2025-8328 code-projects Exam Form Submission register.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument USN leads to sql injection. The attack may be launched remotely. The exploi...

Exploit for CVE-2025-52390

🔍 Vulnerability Research & Security Disclosures by Harsh Koth...

WordPress Magical Posts Display Plugin plugin <= 1.2.52 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Abu Hurayra in WordPress Plugin Magical Posts Display versions = 1.2.52...

WordPress Integrate Google Drive plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Integrate Google Drive versions = 1.5.2...

WordPress Ebook Store Plugin plugin <= 5.8013 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Ebook Store versions = 5.8013...

WordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection Vulnerability

Content Injection Vulnerability discovered by Denver Jackson in WordPress Plugin Classified Listing versions = 5.0.0...

WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Button Block versions = 1.2.0...

WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability

Insecure Direct Object References IDOR Vulnerability discovered by Bao BlueRock in WordPress Plugin Motors versions = 1.4.80...

WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetEngine versions = 3.7.1.2...

WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Connector for Gravity Forms and Google Sheets versions = 1.2.4...

WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.5.3...

WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin YITH WooCommerce Popup versions = 1.48.0...

WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Product Configurator for WooCommerce versions = 1.4.4...

WordPress Photo Engine Plugin plugin <= 6.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Photo Engine versions = 6.4.3...

WordPress oik plugin <= 4.15.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin oik versions = 4.15.2...

WordPress myCred plugin <= 2.9.4.3 - Race Condition Vulnerability

Race Condition Vulnerability discovered by Esteban Montes Morales in WordPress Plugin myCred versions = 2.9.4.3...

WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin TheBooking versions = 1.4.4...

WordPress BeeTeam368 Extensions Plugin <= 1.9.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds in WordPress Plugin BeeTeam368 Extensions versions = 1.9.4...

WordPress Realtyna Organic IDX plugin <= 5.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Realtyna Organic IDX plugin versions = 5.0.0...