CVE-2025-22165

CVE-2025-22165 describes an ARBITRARY CODE EXECUTION vulnerability in Sourcetree for Mac starting with version 4.2.8. The flaw is exploitable by a locally authenticated attacker who can execute code with the user’s privileges, impacting confidentiality, integrity, and availability. The CVSS data ...

WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin WooCommerce Point Of Sale POS versions = 1.4...

WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.5.3...

WordPress Omnishop plugin <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint vulnerability

Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint vulnerability discovered by ch4r0n in WordPress Plugin Omnishop versions = 1.0.9...

Debian: Security Advisory (DLA-4248-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2025:02463-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7663-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Supreme Addons for Beaver Builder plugin <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via autoqrcodesabb Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Supreme Addons for Beaver Builder versions = 1.0.9...

WordPress hiWeb Export Posts plugin <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery to Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin hiWeb Export Posts versions = 0.9.0.0...

WordPress Taeggie Feed plugin <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via name Attribute vulnerability discovered by Gilang in WordPress Plugin Taeggie Feed versions = 0.1.10...

WordPress iThoughts Advanced Code Editor plugin <= 1.2.10 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Nabil Irawan in WordPress Plugin iThoughts Advanced Code Editor versions = 1.2.10...

WordPress muse.ai video embedding plugin <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via muse-ai Shortcode vulnerability discovered by Gilang in WordPress Plugin muse.ai video embedding versions = 0.4...

WordPress ONLYOFFICE Docs plugin 1.1.0-2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function

Missing Authorization to Unauthenticated Privilege Escalation via callback Function vulnerability discovered by kr0d in WordPress Plugin ONLYOFFICE versions 1.1.0-2.2.0...

WordPress WP Applink plugin <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via title Parameter vulnerability discovered by Gilang in WordPress Plugin WP Applink versions = 0.4.1...

WordPress WebinarIgnition plugin <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass vulnerability

Unauthenticated Login Token Generation to Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin WebinarIgnition versions = 4.03.32...

WordPress WP Get The Table plugin <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Parameter vulnerability discovered by Gilang in WordPress Plugin WP Get The Table versions = 1.5...

WordPress Get Youtube Subs plugin <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via subscribelinkatt Function vulnerability discovered by Peter Thaleikis in WordPress Plugin Get Youtube Subs versions = 3.5...

WordPress WP Wallcreeper plugin <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable vulnerability

Missing Authorization to Authenticated Susbcriber+ Cache Enable/Disable vulnerability discovered by ch4r0n in WordPress Plugin WP Wallcreeper versions = 1.6.1...

WordPress Station Pro plugin <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via width and height Parameters vulnerability discovered by Peter Thaleikis in WordPress Plugin Station Pro versions = 2.4.2...

WordPress Voltax Video Player plugin <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Gilang in WordPress Plugin Voltax Video Player versions = 1.6.5...