Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass

Exploit Title: Progress Telerik Report Server 2024 Q1 10.0.24.305 - Authentication Bypass Fofa Dork: title="Telerik Report Server" Date: 2024-09-22 Exploit Author: VeryLazyTech GitHub: https://github.com/verylazytech/CVE-2024-4358 Vendor Homepage: https://www.telerik.com/report-server Software...

CVE-2025-26956

Summary (fact-grounded) : CVE-2025-26873 affects the Travel Booking WordPress Theme (Traveler) up to version 3.1.8. It is categorized as an Unauthenticated PHP Object Injection vulnerability due to a missing authorization check. The vulnerability is listed as Patched/Unpatched ? The connected doc...

CVE-2025-30365 SQL Injection in query_geracao_auto.php

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/sistema/controller/querygeracaoauto.php, specifically in the query parameter. This vulnerability allows the execution of arbitrary SQL...

CVE-2025-30361 WeGIA Vulnerable to Broken Authentication - Old Password Validation

WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass...

CVE-2025-26738

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Graham Quick Interest Slider quick-interest-slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through = 3.1.5...

CVE-2025-30805

Cross-Site Request Forgery CSRF vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through = 1.1.8...

CVE-2025-30786

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through = 3.1.0...

CVE-2025-30784 WordPress WP Subscription Forms plugin <= 1.2.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows SQL Injection.This issue affects WP Subscription Forms: from n/a through = 1.2.3...

CVE-2025-30765

CVE-2025-30765 affects Stock Sync for WooCommerce with Google Sheets (FlexStock) and was disclosed as an authenticated SQL Injection vulnerability in FlexStock &lt;= 3.13.1. The issue has a CVSS v3.1 base score of 7.6 (HIGH) with attack vector NETWORK and privileges required HIGH, exploitable wit...

PT-2025-13070 · Unknown +1 · Ez Sql Reports Shortcode Widget +1

Name of the Vulnerable Software and Affected Versions: Eli EZ SQL Reports Shortcode Widget and DB Backup versions through 5.25.08 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...

PT-2025-13104 · Themify · Themify Event Post

Name of the Vulnerable Software and Affected Versions: Themify Event Post versions 1.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local Fi...

PT-2025-24377 · Microhard · Microhard Bulletlte-Na2 +1

Name of the Vulnerable Software and Affected Versions: Microhard BulletLTE-NA2 and IPn4Gii-NA2 affected versions not specified Description: The issue is related to a post-authentication command injection problem in the AT+MFMAC command, which can lead to privilege escalation. This is an instance ...

CVE-2025-28873

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.This issue affects Shuffle: from n/a through = 0.5...

CVE-2025-30546

Cross-Site Request Forgery CSRF vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through = 4.33...

CVE-2025-30585

Cross-Site Request Forgery CSRF vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through = 0.8...

CVE-2025-30560

Cross-Site Request Forgery CSRF vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through = 3.0...

CVE-2025-28942

CVE-2025-28942 describes an SQL injection in the WordPress plugin “Trust Payments Gateway for WooCommerce” affecting versions up to 1.1.4. The vulnerability is categorized as a severe SQL injection with CVSS v3.1 base score 9.3 (CRITICAL); attack vector: NETWORK, complexity: LOW, privileges requi...

CVE-2025-30587

Cross-Site Request Forgery CSRF vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through = 1.73...

CVE-2025-30567

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through = 2.6.2...

CVE-2025-27837

CVE-2025-27837 affects Artifex Ghostscript prior to 10.05.0. A vulnerability in path handling allows access to arbitrary files via a truncated path containing invalid UTF-8 characters in base/gp_mswin.c and base/winrtsup.cpp. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a CRIT...