WordPress Simple History plugin <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode vulnerability

Authenticated Administrator+ Sensitive Information Exposure via Detective Mode vulnerability discovered by Blair Crawford in WordPress Plugin Simple History versions = 5.8.1...

Exploit for Open Redirect in Grafana

Blackash-CVE-2025-4123 CVE-2025-4123 CVE ID: "CVE-2025-4123"...

WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Min Max Step Quantity Limits Manager for WooCommerce versions = 5.1.0...

WordPress Civi Framework plugin <= 2.1.6 - Cross Site Request Forgery (CSRF) to User Deactivation vulnerability

Cross Site Request Forgery CSRF to User Deactivation vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Civi Framework versions = 2.1.6...

CVE-2025-5756

CVE-2025-5756 describes a SQL injection vulnerability in Code-Projects Real Estate Property Management System 1.0, affecting the unknown functionality in the file /Admin/EditCity.php. The root cause is an incorrect operation within that file, enabling remote exploitation. The vulnerability has be...

openSUSE Security Advisory (SUSE-SU-2025:01812-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:01811-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7552-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress StageShow plugin <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via anchor Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin StageShow versions = 10.0.3...

WordPress Developer Formatter plugin <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Custom CSS vulnerability discovered by l33ch in WordPress Plugin Developer Formatter versions = 2015.0.2.1...

WordPress Paged Gallery plugin <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Paged Gallery versions = 0.7...

WordPress Freemind Viewer plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Freemind Viewer versions = 1.0...

WordPress Runners Log plugin <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Runners Log versions = 3.9.2...

WordPress WP Online Users Stats plugin <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting via hkdatasetresults Function vulnerability discovered by rajanhoyr in WordPress Plugin WP Online Users Stats versions = 1.0.0...

WordPress WP-Addpub plugin <= 1.2.8 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by muhammad yudha in WordPress Plugin WP-Addpub versions = 1.2.8...

WordPress WordPress Ajax Load More and Infinite Scroll plugin <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin WordPress Ajax Load More and Infinite Scroll versions = 1.6.0...

WordPress Hive Support plugin <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox vulnerability

Authenticated Subscriber+ Missing Authorization via hsupdateaichatsettings and hivelitesupportgetallbinbox vulnerability discovered by Vo Thi Ngoc Nhi in WordPress Plugin Hive Support versions = 1.2.5...

WordPress Hive Support plugin <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function vulnerability

Cross-Site Request Forgery via hsupdateaichatsettings Function vulnerability discovered by Vo Thi Ngoc Nhi in WordPress Plugin Hive Support versions = 1.2.5...

WordPress ESV Bible Shortcode for WordPress plugin <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin ESV Bible Shortcode for WordPress versions = 1.0.2...