CVE-2025-26902

Cross-Site Request Forgery CSRF vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1...

CVE-2025-3131 ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

WordPress FrescoChat Live Chat plugin <= 3.2.6 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin FrescoChat Live Chat versions = 3.2.6...

CVE-2025-32676

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Blind SQL Injection.This issue affects Verowa Connect: from n/a through = 3.0.5...

CVE-2025-32550 WordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1...

PT-2025-15703 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN versions prior to 9.13.4 Description: The issue allows manipulation of a URL for the ImageHandler to render text from a querystring parameter. This text would be displayed in the resulting image, potentially deceiving users who trust the...

Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS)

Exploit Title: Anchor CMS 0.12.7 - Stored Cross Site Scripting XSS Date: 04/28/2024 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://anchorcms.com/ Software Link: https://github.com/anchorcms/anchor-cms/archive/refs/tags/0.12.7.zip Version: latest Tested on: MacOS Log in to Anchor CMS...

CVE-2025-32211

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

CVE-2025-32413

Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py...

CVE-2025-32273

Cross-Site Request Forgery CSRF vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through = 1.1...

PT-2025-15125 · Nimrod · Nimrod

Name of the Vulnerable Software and Affected Versions: Nimrod version 0.8 Description: A critical issue has been found in the software, affecting some unknown functionality of the file FileRestController.java. The manipulation of the File argument leads to unrestricted upload. The attack can be...

CVE-2025-31789

Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through = 1.9.1...

CVE-2025-32270

Cross-Site Request Forgery CSRF vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

CVE-2025-32174

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tockify Tockify Events Calendar tockify-events-calendar allows DOM-Based XSS.This issue affects Tockify Events Calendar: from n/a through = 2.2.13...

CVE-2025-32148

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Daisycon Daisycon prijsvergelijkers daisycon allows SQL Injection.This issue affects Daisycon prijsvergelijkers: from n/a through = 4.8.4...

CVE-2025-29085

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component...

PT-2025-14886 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum versions 2.4.2 and earlier Description: The issue is related to an Incorrect Privilege Assignment, which allows Privilege Escalation in the wpForo Forum. Recommendations: For versions 2.4.2 and earlier, update to a version that...

CVE-2025-31814

Cross-Site Request Forgery CSRF vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through = 1.2.0...

CVE-2025-31779

Cross-Site Request Forgery CSRF vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through = 1.5.54...

CVE-2025-3159

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buff...