PT-2025-16091 · Unknown · Neoslab Database Toolset

Name of the Vulnerable Software and Affected Versions: neoslab Database Toolset versions 1.8.4 and earlier Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows an attacker to traverse the file system and acce...

WebFileSys 2.31.0 - Directory Path Traversal

Exploit Title: WebFileSys 2.31.0 - Directory Path Traversal in relPath Parameter Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Charanin Thongudom, Pongtorn Angsuchotmetee Vendor Homepage: http://www.webfilesys.de/webfilesys-home/index.html Software Link:...

CVE-2025-32275

Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through = 5.1.6.3...

📄 PandoraFMS 7.0NG.772 SQL Injection

PandoraFMS version 7.0NG.772 proof of concept authenticated remote SQL injection exploit. Exploit Title: PandoraFMS console v7.0NG.772 - SQL Injection Authenticated Date: 21/11/2023 Exploit Author: Osama Yousef Vendor Homepage: https://pandorafms.com/ Software Link:...

📄 Typecho 1.3.0 Cross Site Scripting

Typecho versions 1.3.0 and below suffer from a persistent cross site scripting vulnerability. // Exploit Title: Typecho = 1.3.0 Stored Cross-Site Scripting XSS // Google Dork: intext:"Powered by Typecho" inurl:/index.php // Date: 18/08/2024 // Exploit Author: Michele 'cyberaz0r' Di Bonaventura //...

CVE-2025-26902

Cross-Site Request Forgery CSRF vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1...

CVE-2025-3131 ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

WordPress FrescoChat Live Chat plugin <= 3.2.6 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin FrescoChat Live Chat versions = 3.2.6...

CVE-2025-32676

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Blind SQL Injection.This issue affects Verowa Connect: from n/a through = 3.0.5...

CVE-2025-32550 WordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1...

PT-2025-15703 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN versions prior to 9.13.4 Description: The issue allows manipulation of a URL for the ImageHandler to render text from a querystring parameter. This text would be displayed in the resulting image, potentially deceiving users who trust the...

Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS)

Exploit Title: Anchor CMS 0.12.7 - Stored Cross Site Scripting XSS Date: 04/28/2024 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://anchorcms.com/ Software Link: https://github.com/anchorcms/anchor-cms/archive/refs/tags/0.12.7.zip Version: latest Tested on: MacOS Log in to Anchor CMS...

CVE-2025-32211

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

CVE-2025-32413

Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py...

CVE-2025-32273

Cross-Site Request Forgery CSRF vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through = 1.1...

PT-2025-15125 · Nimrod · Nimrod

Name of the Vulnerable Software and Affected Versions: Nimrod version 0.8 Description: A critical issue has been found in the software, affecting some unknown functionality of the file FileRestController.java. The manipulation of the File argument leads to unrestricted upload. The attack can be...

CVE-2025-31789

Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through = 1.9.1...

CVE-2025-32270

Cross-Site Request Forgery CSRF vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

CVE-2025-32174

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tockify Tockify Events Calendar tockify-events-calendar allows DOM-Based XSS.This issue affects Tockify Events Calendar: from n/a through = 2.2.13...

CVE-2025-32148

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Daisycon Daisycon prijsvergelijkers daisycon allows SQL Injection.This issue affects Daisycon prijsvergelijkers: from n/a through = 4.8.4...