WordPress TicketBAI Facturas para WooCommerce plugin <= 3.19 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by astra.r3verii in WordPress Plugin TicketBAI Facturas para WooCommerce versions = 3.19...

WordPress CLEVER plugin <= 2.6 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin CLEVER versions = 2.6...

WordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Anhchangmutrang Patchstack Alliance in WordPress Plugin MapSVG versions 8.6.13...

WordPress Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery plugin <= 1.0.13 - Directory Traversal Vulnerability

Directory Traversal Vulnerability discovered by Denver Jackson in WordPress Plugin Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery versions = 1.0.13...

WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by timomangcut in WordPress Plugin Membership For WooCommerce versions = 2.8.1...

WordPress One-Login plugin <= 1.4 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by HLog in WordPress Plugin One-Login versions = 1.4...

WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability

Remote Code Execution RCE Vulnerability discovered by ch4r0n Patchstack Alliance in WordPress Plugin Widget Logic versions = 6.0.5...

Advisory ROSA-SA-2025-2890

Software: libjpeg-turbo 1.5.3 OS: ROSA Virtualization 3.0 packageevrstring: libjpeg-turbo-1.5.3-14.rv30 CVE-ID: CVE-2020-13790 BDU-ID: 2021-01352 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the startinputppm function from rdppm.c of the libjpeg-turbo image manipulation library is related to...

CVE-2025-5858

The CVE-2025-5858 entry pertains to PHPGurukul Nipah Virus Testing Management System 1.0. Affects the file /patient-report.php, where the searchdata parameter can be manipulated to induce a SQL injection. This vulnerability enables remote exploitation, and multiple connected sources confirm the i...

WordPress Petito Theme <= 1.6.2 is vulnerable to Local File Inclusion

Software Petito Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-27362 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 93ad82bdf854 Credits Phat RiO - BlueRock Required privilege Unauthenticat...

WordPress CozyStay Theme < 1.7.1 is vulnerable to PHP Object Injection

Software CozyStay Type Theme Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-49507 Patch priority High CVSS severity High 9.8 Developer LoftOcean PSID 87cadbf62283 Credits Bonds Required privilege Unauthenticated Published 9 Jun...

WordPress TinySalt Theme < 3.10.0 is vulnerable to Local File Inclusion

Software TinySalt Type Theme Vulnerable versions 3.10.0 Fixed in 3.10.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49454 Patch priority High CVSS severity High 8.1 Developer LoftOcean PSID f11131feed0e Credits Bonds Required privilege Unauthenticated Published 9...

WordPress SNS Anton Theme <= 4.1 is vulnerable to Local File Inclusion

Software SNS Anton Type Theme Vulnerable versions = 4.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28992 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1a79e587467e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress MediClinic Theme <= 2.1 is vulnerable to Local File Inclusion

Software MediClinic Type Theme Vulnerable versions = 2.1 Fixed in 2.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49295 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 856af99d1029 Credits Bonds Required privilege Unauthenticated Published...

WordPress Themify Edmin Theme <= 2.0.0 is vulnerable to PHP Object Injection

Software Themify Edmin Type Theme Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31047 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID c525fceb3917 Credits Phat RiO - BlueRock Required privilege...

WordPress Nitan Theme <= 2.9 is vulnerable to Local File Inclusion

Software Nitan Type Theme Vulnerable versions = 2.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24768 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ec6d95e09a1c Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Require...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4601 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08bda80a3ca8 Credits Thái An Require...

Ubuntu: Security Advisory (USN-7553-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress CraftXtore Theme <= 1.7 is vulnerable to Local File Inclusion

Software CraftXtore Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24770 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID db65eb0ec141 Credits Phat RiO - BlueRock Required privilege...

WordPress Avaz Theme <= 2.8 is vulnerable to Local File Inclusion

Software Avaz Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-28944 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1dc6fdd3ef9e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Required...