WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Chazz Wolcott Patchstack in WordPress Plugin Responsive Plus versions = 3.2.2...

WordPress Slim SEO plugin <= 4.5.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by ChuongVN in WordPress Plugin Slim SEO versions = 4.5.4...

WordPress Nasa Core Plugin <= 6.4.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin Nasa Core versions = 6.4.4...

WordPress WidgetKit Pro plugin <= 1.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyễn Trung Kiên anhchangmutrang in WordPress Plugin WidgetKit Pro versions = 1.13.1...

WordPress WP Employee Attendance System plugin <= 3.5 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Hiro Code016Hiro in WordPress Plugin WP Employee Attendance System versions = 3.5...

WordPress MapSVG plugin < 8.7.4 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Anhchangmutrang in WordPress Plugin MapSVG versions 8.7.4...

WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WP VR versions = 8.5.26...

WordPress School Management plugin <= 93.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Aiden Thái An in WordPress Plugin School Management versions = 93.0.0...

WordPress WPGYM plugin <= 65.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Aiden Thái An in WordPress Plugin WPGYM versions = 65.0...

WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability

WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin = 3.2.0 - SQL Injection Vulnerability discovered by Phúc ton luoi in WordPress Plugin WPCRM - CRM for Contact form CF7 & WooCommerce versions = 3.2.0...

WordPress PostaPanduri plugin <= 2.1.3 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin PostaPanduri versions = 2.1.3...

WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by LVT-tholv2k in WordPress Plugin FW Food Menu versions = 6.0.0...

WordPress Workreap plugin <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' vulnerability

Authenticated Subscriber+ Arbitrary File Upload via 'workreaptempuploadtomedia' vulnerability discovered by Foxyyy in WordPress Plugin Workreap theme's plugin versions = 3.3.2...

WordPress Workreap plugin <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account' vulnerability

Authentication Bypass via 'workreapverifyuseraccount' vulnerability discovered by Foxyyy in WordPress Plugin Workreap theme's plugin versions = 3.3.1...

WordPress OAuth Single Sign On (SSO) plugin <= 18.5.3 - Incorrect Authorization to Sensitive Information Exposure vulnerability

Incorrect Authorization to Sensitive Information Exposure vulnerability discovered by Israël Hallé Flare - Flare in WordPress Plugin OAuth Single Sign On - SSO OAuth Client versions = 18.5.3...

WordPress ZotPress plugin <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname' vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'nickname' vulnerability discovered by mohamed hamadou ZoeniX in WordPress Plugin Zotpress versions = 7.3.15...

CVE-2025-6008

A vulnerability has been found in kiCode111 like-girl 5.2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ImgAddPost.php. The manipulation of the argument imgDatd/imgText/imgUrl leads to sql injection. The attack can be launched remotely...

Debian: Security Advisory (DLA-4215-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2025-0181)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2025-0178)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...