SUSE: Security Advisory (SUSE-SU-2025:1125-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2025-0128)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-3323

A vulnerability classified as critical was found in godcheese/code-projects Nimrod 0.8. Affected by this vulnerability is the function searchAllByName of the file ViewMenuCategoryRestController.java. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

JSP Web Shell Uploader A simple Python tool for uploading a basi...

CVE-2025-3259

A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely...

WordPress Drag and Drop Multiple File Upload for WooCommerce plugin <= 1.1.4 - Unauthenticated Arbitrary File Move vulnerability

Unauthenticated Arbitrary File Move vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Drag and Drop Multiple File Upload for WooCommerce versions = 1.1.4...

WordPress Lafka Plugin plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update vulnerability

Missing Authorization to Authenticated Subscriber+ Theme Option Update vulnerability discovered by István Márton in WordPress Plugin Lafka Plugin versions = 7.1.0...

WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation vulnerability

WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin = 6.91 - Missing Authorization to Authenticated Subscriber+ Limited Options Update and Settings Manipulation vulnerability discovered by Lucio Sá in WordPress Plugin ZoomSounds versions = 6.91...

WordPress ZoomSounds plugin <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by István Márton in WordPress Plugin ZoomSounds versions = 6.91...

WordPress WC Marketplace plugin <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion vulnerability

Missing Authorization to Unauthenticated Table Rates Deletion vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin MultiVendorX versions = 4.2.19...

WordPress KB Support plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin KB Support versions = 1.7.4...

WordPress AI Content Pipelines plugin <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin AI Content Pipelines versions = 1.6...

WordPress Read More & Accordion plugin <= 3.4.5 - Cross-Site Request Forgery to Local File Inclusion vulnerability

Cross-Site Request Forgery to Local File Inclusion vulnerability discovered by Bassem Essam in WordPress Plugin Read More & Accordion versions = 3.4.7...

WordPress Link Library plugin <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Link Additional Parameters vulnerability discovered by siavashvafshar in WordPress Plugin Link Library versions = 7.7.3...

WordPress Maps - Google Maps plugin <= 1.0.6 - Contributor+ Stored XSS vulnerability

WordPress Maps - Google Maps plugin = 1.0.6 - Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Maps versions = 1.0.6...

Exploit for Path Traversal in Yeswiki

--- CVE-2025-31131 - YesWiki 4.5.2 Path Traversal Exploit...

WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Manab Jyoti Dowarah in WordPress Plugin WP Project Manager versions 2.6.25...

WordPress Live Forms plugin <= 4.8.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Live Forms versions = 4.8.5...

WordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Mika in WordPress Plugin Table Block by RioVizual versions = 2.3.1...

WordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das in WordPress Plugin RepairBuddy versions = 3.8213...