WordPress MasterStudy LMS Pro plugin <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Thái An in WordPress Plugin MasterStudy LMS Pro versions = 4.7.9...

WordPress Attachment Manager plugin <= 2.1.2 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin Attachment Manager versions = 2.1.2...

WordPress WooCommerce Refund And Exchange with RMA plugin <= 3.2.6 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin WooCommerce Refund And Exchange with RMA versions = 3.2.6...

WordPress B1.lt for WooCommerce plugin <= 2.2.56 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary SQL Injection vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin B1.lt for WooCommerce versions = 2.2.56...

WordPress Useful Tab Block plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via className Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Useful Tab Block versions = 1.3.2...

WordPress Testimonial Post type plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via autoplay Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Testimonial Post type versions = 1.2.1...

WordPress Listly plugin <= 2.7 - Unauthenticated Arbitrary Transient Deletion vulnerability

Unauthenticated Arbitrary Transient Deletion vulnerability discovered by ch4r0n in WordPress Plugin Listly versions = 2.7...

WordPress Vertical scroll image slideshow gallery plugin <= 11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via width Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Vertical scroll image slideshow gallery versions = 11.1...

WordPress Block Editor Gallery Slider plugin <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Post Meta Update vulnerability discovered by Poli in WordPress Plugin Block Editor Gallery Slider versions = 1.1.1...

WordPress Crowdfunding for WooCommerce plugin <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via width Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Crowdfunding for WooCommerce versions = 3.1.14...

WordPress aapanel WP Toolkit plugin 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function vulnerability

WordPress aapanel WP Toolkit plugin 1.0 - 1.1 - Missing Authorization to Authenticated Subscriber+ Privilege Escalation via autologin Function vulnerability discovered by kr0d in WordPress Plugin aapanel WP Toolkit versions 1.0 - 1.1...

WordPress Map My Locations plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Map My Locations versions = 1.1...

WordPress Ruven Themes: Shortcodes plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Ruven Themes: Shortcodes versions = 1.0...

WordPress Copymatic plugin <= 2.1 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Copymatic versions = 2.1...

WordPress School Management System plugin <= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update vulnerability

Authenticated Subscriber+ Local File Inclusion to Privilege Escalation via Password Update vulnerability discovered by Thái An in WordPress Plugin School Management versions = 93.1.0...

XWiki 15.9-rc-1 < 15.10.8, 16.0.0-rc-1 < 16.2.0 RCE Vulnerability (GHSA-mvgm-3rw2-7j4r)

Xwiki is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki 13.5-rc-1 < 15.10.13, 16.0.0-rc-1 < 16.4.4, 16.5.0-rc-1 < 16.8.0 Open Redirect Vulnerability (GHSA-pjhg-9wr9-rj96)

Xwiki is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

SUSE: Security Advisory (SUSE-SU-2025:02329-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-7751

A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addclinic.php. The manipulation of the argument cid leads to sql injection. The attack can be launched...

openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1;...