PT-2025-24395 · Unknown · Phpgurukul Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Maid Hiring Management System version 1.0 Description: A critical issue was found in the PHPGurukul Maid Hiring Management System. This issue affects an unknown part of the file /admin/search-booking-request.php. The manipulation o...

CVE-2025-30953

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through = 1.4.7...

CVE-2025-49238

Cross-Site Request Forgery CSRF vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through = 2.3.3...

CVE-2025-28981

Cross-Site Request Forgery CSRF vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through = 0.2.3...

CVE-2025-29877 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-49286

Cross-Site Request Forgery CSRF vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through = 2.0.6...

CVE-2025-49235

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through = 1.6.0...

CVE-2025-30980

Cross-Site Request Forgery CSRF vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through = 1.5...

CVE-2025-30956

Cross-Site Request Forgery CSRF vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This issue affects Booqable Rental: from n/a through = 2.4.25...

CVE-2025-49446

CVE-2025-49446 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Admin Notes (minhlaobao). Affected range: Admin Notes 1.1 and earlier (n/a through 1.1). According to the initial description, the CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N wit...

CVE-2025-28958

CVE-2025-28958 is a CSRF to Stored XSS in Bg Orthodox Calendar. Affected software: Bg Orthodox Calendar (from n/a up to version 0.13.10). Root cause: CSRF enabling stored XSS. CVSS 3.1 base score 7.1 (HIGH) with network attack vector, low attack complexity, no privileges, user interaction require...

CVE-2025-29013 WordPress Custom Category/Post Type Post order plugin <= 1.6.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Category/Post Type Post order: from n/a through = 1.6.0...

CVE-2025-30968

CVE-2025-30968 describes a Cross-Site Request Forgery (CSRF) affecting the WordPress plugin Advanced Post List . Connected sources indicate the issue affects versions from an unspecified baseline up to 0.5.6.2. The Red Hat entry reiterates the CSRF nature of the vulnerability in the same componen...

CVE-2025-30976

CVE-2025-30976 is a reported SSRF vulnerability in Nexa Blocks (wpdive) that affects Nexa Blocks versions up to and including 1.1.0. The connected documents confirm an SSRF issue but do not provide a concrete root-cause breakdown beyond the vulnerability class, nor any remediation or patched vers...

CVE-2025-30995

The CVE-2025-30995 entry refers to the OTWthemes Widgetize Pages Light WordPress plugin, affected in versions 3.0 and earlier. The vulnerability is a Cross-Site Request Forgery (CSRF) that enables Stored XSS. Public sources consistently describe the issue as CSRF-to-Stored XSS and indicate versio...

CVE-2025-49325 WordPress Newspack Newsletters <= 3.13.0 - Open Redirection Vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Automattic Newspack Newsletters allows Phishing. This issue affects Newspack Newsletters: from n/a through 3.13.0...

CVE-2025-49238

CVE-2025-49238 is a CSRF vulnerability in the Everest Backup WordPress plugin by Everest Themes affecting versions up to 2.3.3. The Wordfence vulnerability entry notes this was a Cross-Site Request Forgery issue with a CVSS v3.1 base score of 4.3 (Medium) and indicates patching has been applied i...

PT-2025-24064

Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description The issue concerns an unrestricted upload of files with dangerous types in the upload file function, allowing remote attackers to execute arbitrary...

CVE-2025-49009 Para Inserts Sensitive Information into Log File for Facebook authentication

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in FacebookAuthFilter.java results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access...

CVE-2025-49008 Atheos Improper Input Validation Vulnerability Enables RCE in Common.php

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable version...