WordPress Payday plugin <= 3.3.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Payday versions = 3.3.18...

WordPress Docxpresso plugin <= 2.6 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Docxpresso versions = 2.6...

WordPress XV Random Quotes plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin XV Random Quotes versions = 2.0.0...

WordPress Booking Calendar and Notification plugin <= 4.0.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Pham Van Tam Patchstack Alliance in WordPress Plugin Booking Calendar and Notification versions = 4.0.3...

WordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pham Van Tam Patchstack Alliance in WordPress Plugin Booking Calendar and Notification versions = 4.0.3...

WordPress Team Builder plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Team Builder versions = 1.3...

WordPress MyBookProgress by Stormhill Media plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin MyBookProgress by Stormhill Media versions = 1.0.8...

WordPress CF7 Spreadsheets plugin <= 2.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin CF7 Spreadsheets versions = 2.3.2...

WordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k in WordPress Plugin Testimonial Slider versions = 2.0.13...

WordPress TuriTop Booking System plugin <= 1.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin TuriTop Booking System versions = 1.0.10...

WordPress Category Icon plugin <= 1.0.1 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by minhtuanact in WordPress Plugin Category Icon versions = 1.0.1...

CVE-2025-3146 PHPGurukul Bus Pass Management System view-pass-detail.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Bus Pass Management System 1.0. This affects an unknown part of the file /view-pass-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

WordPress MapPress Maps for WordPress plugin < 2.94.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin MapPress Maps for WordPress versions 2.94.9...

WordPress Modula Image Gallery plugin <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Modula Image Gallery versions = 2.10.1...

WordPress LuckyWP Table of Contents plugin <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Reflected Cross-Site Scripting vulnerability discovered by mikemyers in WordPress Plugin LuckyWP Table of Contents versions = 2.1.10...

CVE-2025-3140

A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /viewcategory.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2025-3135

A vulnerability classified as critical was found in fcbazzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /api/system/dept/update. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the...

WordPress Wigi Theme <= 2.0.1 is vulnerable to Arbitrary File Upload

Software Wigi Type Theme Vulnerable versions = 2.0.1 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2025-30996 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID a3f5b750c9b1 Credits Tran Nguyen Bao Khanh VCI - VNPT...

Mageia: Security Advisory (MGASA-2025-0122)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Slide Theme <= 1.7.5 is vulnerable to Arbitrary File Upload

Software Slide Type Theme Vulnerable versions = 1.7.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-30996 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 93c6f7b48621 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...