PT-2025-10992 · WordPress · Simple Amazon Affiliate

Name of the Vulnerable Software and Affected Versions: The Simple Amazon Affiliate plugin for WordPress versions up to, and including, 1.0.9 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping via the msg parameter. This...

Malicious code in simple-progress-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b0b2ded38b63b01027590e0a217718f8b204d46705ecbb37c8d33733ffa1177 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2281 Malicious code in simple-progress-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b0b2ded38b63b01027590e0a217718f8b204d46705ecbb37c8d33733ffa1177 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Simple Amazon Affiliate plugin <= 1.0.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by siyuan shao in WordPress Plugin Simple Amazon Affiliate versions = 1.0.9...

Malicious code in simple-export-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d44defb42445d3a7511f32616401e72a003e6eee8f3e47cd2ca1f41b4026f65b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2280 Malicious code in simple-export-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d44defb42445d3a7511f32616401e72a003e6eee8f3e47cd2ca1f41b4026f65b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

CVE-2024-10924 CVE-2024-10924 - Authentication Bypass in Reall...

CVE-2024-13866 Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2022-24806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an...

WordPress plugin Simple Notification 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Simple Notification plugin <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Pham Van Tam in WordPress Plugin Simple Notification versions = 1.3...

Linux Distros Unpatched Vulnerability : CVE-2019-7574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMAADPCMdecode in audio/SDLwave.c. CVE-2019-7574 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2019-7635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDLblit1.c. CVE-2019-7635 Note that...

Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail

Threat actors are targeting Amazon Web Services AWS environments to push out phishing campaigns to unsuspecting targets, according to findings from Palo Alto Networks Unit 42. The cybersecurity company is tracking the activity cluster under the name TGR-UNK-0011 short for a threat group with...

WordPress Simple Download Counter plugin <= 2.0 - Authenticated (Author+) Arbitrary File Read vulnerability

Authenticated Author+ Arbitrary File Read vulnerability discovered by omstaendlig in WordPress Plugin Simple Download Counter versions = 2.0...

The vulnerability of the Simple Network Management Protocol (SNMP) implementation in Cisco IOS, Cisco IOS XR, and Cisco IOS XE operating systems allows a attacker to trigger a service failure.

The vulnerability of the Simple Network Management Protocol SNMP implementation in Cisco IOS, Cisco IOS XR, and Cisco IOS XE operating systems is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service...

CVE-2025-1730 Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read

The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simpledownloadcounterdownloadhandler'. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data includi...

CVE-2025-1730

CVE-2025-1730 affects the WordPress Simple Download Counter plugin up to version 2.0, enabling an Arbitrary File Read via the simple_download_counter_download_handler. Exploitation requires authenticated access at Author level or higher; impact includes reading sensitive local files (e.g., wp-con...

CVE-2024-13518

The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.11. This is due to missing or incorrect nonce validation on the 'spsaveeditedpost' function. This makes it possible for unauthenticated attackers to modify a forum po...

CVE-2024-13518 Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing

The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing or incorrect nonce validation on the 'spsaveeditedpost' function. This makes it possible for unauthenticated attackers to modify a forum po...