CVE-2014-125047

A vulnerability classified as critical has been found in tbezman school-store. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 2957fc97054216d3a393f1775efd01ae2b072001. It is recommended to apply a patch to fix this issue. The identifier...

CVE-2009-1225

Cross-site scripting XSS vulnerability in index.php in Turnkey Ebook Store 1.1 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action...

CVE-2009-1320

Multiple cross-site scripting XSS vulnerabilities in include/zstore.php in Zazzle Store Builder 1.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 gridPage and 2 gridSort parameters. NOTE: some of these details are obtained from third party information...

CVE-2025-39445

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.2...

Exploit for Unrestricted Upload of File with Dangerous Type in Emagicone Emagicone_Store_Manager_For_Woocommerce

eMagicOne Store Manager for WooCommerce Warning: Trying to a...

CVE-2025-37991

In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point...

GHSA-HJQ4-87XH-G4FV vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Impacted Environments This issue ONLY impacts environments using the PyNcclPipe KV cache transfer integration with the V0 engine. No other configurations are affected. Summary vLLM supports the use of the PyNcclPipe class to establish a peer-to-peer communication domain for data transmission...

CVE-2025-37991 parisc: Fix double SIGFPE crash

In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point...

CVE-2025-39445

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.2...

CVE-2025-39445 WordPress Super Store Finder <= 7.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.2...

CVE-2025-39445

CVE-2025-39445 is a SQL Injection in WordPress plugin Super Store Finder (versions

CVE-2025-39445 WordPress Super Store Finder <= 7.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.2...

RAR: Setting Knowledge Tripwires for Retrieval Augmented Rejection

Content moderation for large language models LLMs remains a significant challenge, requiring flexible and adaptable solutions that can quickly respond to emerging threats. This paper introduces Retrieval Augmented Rejection RAR, a novel approach that leverages a retrieval-augmented generation RAG...

PT-2025-22080 · Highwarden · Highwarden Super Store Finder

Name of the Vulnerable Software and Affected Versions: highwarden Super Store Finder versions n/a through 7.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

WordPress plugin Super Store Finder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress JSP Store Locator plugin <= 1.0 - Deletion via Missing CSRF vulnerability

Deletion via Missing CSRF vulnerability discovered by Bob Matyas in WordPress Plugin JSP Store Locator versions = 1.0...

CVE-2024-12301

The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-11267

The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the abstractsqlstore.go component. An attacker can manipulate SQL queries and access or alter database information without proper authorization by injecting malicious SQL statements. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication due to the CookieStore configuration. An attacker can gain unauthorized access by brute-forcing the authentication tags of the session cookies. Note: This is only exploitable if the user has configured the sessio...