PT-2025-52668

Name of the Vulnerable Software and Affected Versions Frappe Framework version 15.89.0 Description A flaw exists within the Attachments module that permits arbitrary file uploads. Successful exploitation, involving the upload of a specially crafted XML file, could lead to the execution of arbitra...

CVE-2025-15010

creationtimestamp| type| source ---|---|--- 2025-12-21 16:41:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115758548213050294 2025-12-22 04:44:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3makgevfsth2a 2025-12-22 04:57:15+00:00| seen|...

CVE-2025-7733

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'csupdateapplicationstatuscallback' due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2025-14992

creationtimestamp| type| source ---|---|--- 2025-12-21 07:05:48+00:00| seen| https://infosec.exchange/users/offseq/statuses/115756285723242241 2025-12-21 07:05:59+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mai5seglda2g 2025-12-22 04:06:09+00:00| seen|...

CVE-2025-14991

creationtimestamp| type| source ---|---|--- 2025-12-21 04:21:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115755637973455716 2025-12-21 05:39:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mahyxjymh22x...

EUVD-2025-204640

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'csupdateapplicationstatuscallback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers,...

CVE-2025-7782

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'csupdateapplicationstatuscallback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers,...

CVE-2025-7782

CVE-2025-7782 affects the WP JobHunt plugin for WordPress (used by the JobCareer theme). Root cause: a missing capability check in cs_update_application_status_callback affects all versions up to 7.7, enabling authenticated attackers with Candidate+ privileges to modify data and inject cross-site...

CVE-2025-7782 WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'csupdateapplicationstatuscallback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers,...

CVE-2025-7733 WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'csupdateapplicationstatuscallback' due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2025-14994

creationtimestamp| type| source ---|---|--- 2025-12-20 13:39:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115752169878997594 2025-12-21 05:18:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115755862191715033 2025-12-21 08:29:17+00:00| seen|...

CVE-2025-14995

creationtimestamp| type| source ---|---|--- 2025-12-20 13:26:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115752119093198094 2025-12-21 09:12:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maieuis2xj22 2025-12-21 10:03:10+00:00| seen|...

CVE-2025-14993

creationtimestamp| type| source ---|---|--- 2025-12-20 08:15:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115750896189944926 2025-12-21 04:21:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115755638012851704 2025-12-21 05:36:02+00:00| seen|...

CVE-2025-14961

creationtimestamp| type| source ---|---|--- 2025-12-20 07:27:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115750707517759993...

CVE-2025-14959

creationtimestamp| type| source ---|---|--- 2025-12-20 05:33:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115750259198918758...

CVE-2025-14955

creationtimestamp| type| source ---|---|--- 2025-12-20 04:36:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115750034748201822...

CVE-2025-14952

creationtimestamp| type| source ---|---|--- 2025-12-20 04:36:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115750034696710607...

CVE-2025-13329

creationtimestamp| type| source ---|---|--- 2025-12-20 04:04:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/115749910664280235 2025-12-20 06:57:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mafmtpkrxo2q 2025-12-20 10:31:27+00:00| seen|...

SUSE CVE-2025-14876

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service DoS on the host system by causing the QEMU process to terminate...

CVE-2025-66911

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...