Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data

Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...

CVE-2025-10556

creationtimestamp| type| source ---|---|--- 2025-10-13 08:13:36+00:00| seen| Telegram/DLYbgs5llWKu1oMGQOtozbVt2oAHZcDrgNZsESxJ4FyEZM...

CVE-2025-60868

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...

WordPress Big Post Shipping for WooCommerce plugin cross-site scripting vulnerability

WordPress Big Post Shipping for WooCommerce plugin is a WooCommerce plugin that is mainly used to display real-time shipping quotes and logistics options in WooCommerce websites. The WordPress Big Post Shipping for WooCommerce plugin suffers from a cross-site scripting vulnerability that stems fr...

Linux Distros Unpatched Vulnerability : CVE-2023-53620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - md: fix soft lockup in statusresync statusresync will calculate 'currresync - recoveryactive' to show user a progress bar like following: ============...

WordPress Cost Calculator Builder plugin unauthorized data modification vulnerability

WordPress Cost Calculator Builder plugin is a WordPress plugin for creating price estimation forms that supports quick generation of customized calculators via drag-and-drop form builder that can be embedded in website pages without programming. The WordPress Cost Calculator Builder plugin suffer...

CVE-2025-11634

creationtimestamp| type| source ---|---|--- 2025-10-12 13:35:18+00:00| seen| https://bsky.app/profile/potato.software/post/3m2yswfp42k2d...

CVE-2025-11380

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everestprocessstatus' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for...

CVE-2025-11604

A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2025-11604

A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2025-11604

CVE-2025-11604 affects ProjectWorlds Online Ordering Food System 1.0. The vulnerability arises from improper handling of the Status parameter in /all-orders.php, allowing an SQL injection via remote exploitation. Public exploit disclosed. Multiple sources (NVD, Red Hat, EUVD, CNNVD, CVE listing) ...

CVE-2025-11604 projectworlds Online Ordering Food System all-orders.php sql injection

A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2021-30118

creationtimestamp| type| source ---|---|--- 2025-10-11 05:03:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-30118.yaml 2025-10-12 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-10-12 2025-10-12...

CVE-2025-58278

creationtimestamp| type| source ---|---|--- 2025-10-11 04:13:28+00:00| seen| Telegram/eT9xxUCKTbo9KrWXk8bHkmmubRCP4US2Yx2QZChaF2omfq0...

EUVD-2025-33805

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everestprocessstatus' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for...

CVE-2025-11380

CVE-2025-11380 affects the Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin. Public details in connected docs confirm a missing capability check on the AJAX action named ‘everest_process_status’ that can allow unauthenticated attackers to discover backup file locations...

CVE-2025-11380 Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everestprocessstatus' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for...

CVE-2025-11380 Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everestprocessstatus' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for...

PT-2025-41630

Name of the Vulnerable Software and Affected Versions Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin versions prior to 2.3.6 Description The Everest Backup plugin for WordPress allows unauthorized access to data due to a missing capability check on the everest proces...

Projectworlds Online Ordering Food System SQL注入漏洞

Projectworlds Online Ordering Food System is an online ordering food system from Projectworlds. A SQL injection vulnerability exists in Projectworlds Online Ordering Food System version 1.0, which stems from an incorrect manipulation of the parameter Status in the file /all-orders.php, which coul...