CVE-2025-32116

CVE-2025-32116 is a reflected XSS vulnerability in the WordPress plugin QR Master. The connected Wordfence WordPress vulnerability report lists QR Master (affected through version 1.0.5) with the issue described as improper neutralization of input during web page generation, enabling reflected cr...

CVE-2025-2805

CVE-2025-2805 is an unauthenticated arbitrary shortcode execution in the ORDER POST WordPress plugin (versions up to 2.0.2). The root cause is improper validation before running do_shortcode, enabling attackers to execute arbitrary shortcodes. Wordfence & the CVE entry list this as a high-severit...

BELL-CVE-2025-31498

Bulletin has no description...

IP Address Spoofing

github.com/phires/go-guerrilla is vulnerable to IP address spoofing. The vulnerability is due to improper enforcement of the PROXY protocol due to the server accepting multiple PROXY commands, allowing clients to override the original IP address...

Remote Code Execution (RCE)

github.com/jaredallard/archives is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper archive parsing due to insufficient validation of specially crafted archive files, which allows an attacker to execute arbitrary code or modify files in the context of the user running...

SS-2025-001 - User enumeration via timing attack

More info at https://www.silverstripe.org/download/security-releases/ss-2025-001...

PT-2025-16016

Name of the Vulnerable Software and Affected Versions Arm Ltd Valhall GPU Kernel Driver versions r29p0 through r53p0 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r53p0 TP-Link Smart Hub versions prior to an unspecified fixed version Description A Use After Free issue ...

PT-2025-23104

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave...

PT-2025-15962 · Sharethis · Sharethis Dashboard For Google Analytics

Name of the Vulnerable Software and Affected Versions: ShareThis Dashboard for Google Analytics versions 3.2.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2025-15988 · Unknown · Codeastro Internet Banking System

Name of the Vulnerable Software and Affected Versions: Code Astro Internet Banking System version 2.0.0 Description: A Remote Code Execution RCE vulnerability exists due to improper file upload validation in the profile pic parameter within pages view client.php. Recommendations: Code Astro...

WordPress Customify Theme <= 0.4.8 is vulnerable to Broken Access Control

Software Customify Type Theme Vulnerable versions = 0.4.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-26920 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6338c0e15242 Credits Fariq Fadillah Gusti Insani Required...

PT-2025-15986 · Ibm · Ibm Maximo Application Suite

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite versions 8.11 through 9.0 Description: The issue is related to improper input validation, allowing an authenticated user to perform unauthorized actions. Recommendations: For versions 8.11 through 9.0, update to a...

PT-2025-20730 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: The issue concerns a remote code execution vulnerability in the formSafeEmailFilter function. This allows for unauthorized execution of code, potentially leading to security breaches. Recommendations:...

WordPress Embedder plugin 1.3-1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by kr0d in WordPress Plugin Embedder versions 1.3-1.3.5...

WordPress Checkout Mestres WP plugin <= 8.7.5 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by LVT-tholv2k in WordPress Plugin Checkout Mestres WP versions = 8.7.5...

WordPress Essential Breadcrumbs plugin <= 1.1.1 - CSRF to Privilege Escalation vulnerability

CSRF to Privilege Escalation vulnerability discovered by LVT-tholv2k in WordPress Plugin Essential Breadcrumbs versions = 1.1.1...

WordPress Advanced Tag Lists plugin <= 1.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Advanced Tag Lists versions = 1.2...

WordPress Request Call Back plugin <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Request Call Back versions = 1.4.1...

WordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Tournamatch versions = 4.7.0...

WordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Twispay Credit Card Payments versions = 2.1.2...