CVE-2024-12364

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection. This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the...

WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Cron Logger versions = 1.3.0...

CVE-2025-53270

Cross-Site Request Forgery CSRF vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through = 1.7.0...

CVE-2025-24760

CVE-2025-24760 affects the WordPress theme Sofass (Sofass: &lt;= 1.3.4). Described as an unauthenticated Local File Inclusion via Improper Control of Filename for Include/Require, i.e., PHP Remote File Inclusion. CVSS v3.1 base score 8.1 (HIGH) with network attack vector, high impact on confident...

CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin

The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...

WordPress BuddyPress Docs plugin < 2.2.5 - Subscriber+ Arbitrary Document Read/Update vulnerability

Subscriber+ Arbitrary Document Read/Update vulnerability discovered by Terrence Bosco, Alexus Bosco, Andrew Risorto in WordPress Plugin BuddyPress Docs versions 2.2.5...

MAL-2025-5362 Malicious code in aquasec-orb-test-project (npm)

The package communicates with a domain associated with malicious activity...

PT-2025-27175 · Unknown · Import External Attachments

Name of the Vulnerable Software and Affected Versions: ryanpcmcquen Import external attachments versions 1.5.12 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that affects the Import external attachments feature, allowing unauthorized requests to be made on...

PT-2025-27169 · Unknown · Writesonic

Name of the Vulnerable Software and Affected Versions: Writesonic versions 1.0.0 through 1.0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks...

PT-2025-27122

Name of the Vulnerable Software and Affected Versions: QuanticaLabs CSS3 Vertical Web Pricing Tables versions n/a through 1.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This mean...

PT-2025-27152 · Unknown · Burst Statistics

Name of the Vulnerable Software and Affected Versions: Burst Statistics versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...

PT-2025-27189 · Unknown · Thumbnail Editor

Name of the Vulnerable Software and Affected Versions: Thumbnail Editor versions through 2.3.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...

PT-2025-27109 · Unknown · Syed Tahir Ali Jan Bulk Youtube Post Creator

Name of the Vulnerable Software and Affected Versions: Syed Tahir Ali Jan Bulk YouTube Post Creator versions 1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks...

PT-2025-27171 · Unknown · Onet Regenerate Thumbnails

Name of the Vulnerable Software and Affected Versions: ONet Regenerate Thumbnails versions 1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the...

PT-2025-27224 · Unknown · Track Everything

Name of the Vulnerable Software and Affected Versions: Track Everything versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-27161 · Cyrlitera · Cyrlitera

Name of the Vulnerable Software and Affected Versions: Cyrlitera versions 1.2.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 1.2.0 and earlier, update to a...

PT-2025-27034

Name of the Vulnerable Software and Affected Versions: Flock Safety Gunshot Detection devices versions prior to 1.3 Description: The issue concerns a hard-coded password for a connection in Flock Safety Gunshot Detection devices. This hardcoded password allows for unauthenticated access to the...

PT-2025-27255

Name of the Vulnerable Software and Affected Versions: xiaoyunjie openvpn-cms-flask versions 1.2.7 and earlier Description: A critical issue has been found in the User Creation Endpoint component, specifically affecting the create user function in the /app/api/v1/openvpn.py file. The manipulation...

PT-2025-27131 · Unknown · Apuswp Domnoo

Name of the Vulnerable Software and Affected Versions: ApusWP Domnoo versions 1.49 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

PT-2025-27093 · Unknown · Content No Cache

Name of the Vulnerable Software and Affected Versions: Content No Cache versions 0.1.3 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection. This vulnerability affects the Content No Cache software...