WordPress File Provider plugin <= 1.2.3 - Item Deletion via CSRF vulnerability

Item Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin File Provider versions = 1.2.3...

WordPress File Provider plugin <= 1.2.3 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Nxploited Khaledalenazi in WordPress Plugin File Provider versions = 1.2.3...

CVE-2025-5606 Tenda AC18 SetIPTVCfg formSetIptv command injection

A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/SetIPTVCfg. The manipulation of the argument list leads to command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-5603 Campcodes Hospital Management System registration.php sql injection

A vulnerability has been found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /registration.php. The manipulation of the argument fullname/username leads to sql injection. The attack can be launched...

WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

CVE-2025-1701

CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally...

CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

CVE-2025-1701

CVE-2025-1701 affects MIM Admin Service prior to 7.2.13, 7.3.8, or 7.4.3. The issue allows a local attacker with access to the RMI interface (bound to 127.0.0.1) to send a specially crafted request and execute arbitrary code with the privileges of the MIM Admin service. The RMI surface is locally...

WordPress Wishlist plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Wishlist versions = 2.1.0...

WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by LVT-tholv2k in WordPress Plugin Stock Locations for WooCommerce versions = 2.8.6...

WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.1...

WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Backup and Staging by WP Time Capsule versions = 1.22.23...

CVE-2025-48958

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by...

WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by LVT-tholv2k in WordPress Plugin MultiVendorX versions = 4.2.22...

WordPress elfsight Contact Form widget plugin <= 2.3.1 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin elfsight Contact Form widget versions = 2.3.1...

WordPress Team Builder plugin <= 1.5.7 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Team Builder versions = 1.5.7...

WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohamed Ali - @0vulns / 0Bytes Security in WordPress Plugin InWave Jobs versions = 3.5.8...

WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Spice Blocks versions = 2.0.7.4...

CVE-2025-5580

A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...