CVE-2025-24636

CVE-2025-24636 : WordPress MachForm Shortcode (Laymance Technologies LLC) has a CSRF to Stored XSS vulnerability affecting MachForm Shortcode versions up to 1.4.1. The vulnerability is rated with CVSSv3.1 base score 7.1 (HIGH). Public references indicate the issue exists in the plugin from n/a th...

I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies

I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies. Last year, 74 vulnerabilities were classified as trending to compare the scale, just over 40,000 were added to NVD in 2024. All trending vulnerabilities are found in Western commercial products and...

CVE-2025-23776

Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through = 1.0.4.2...

CVE-2025-23426

Cross-Site Request Forgery CSRF vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through = 1.0...

CVE-2025-23776 WordPress Cache Sniper for Nginx plugin <= 1.0.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through = 1.0.4.2...

CVE-2025-23426 WordPress go Social plugin <= 1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through = 1.0...

CVE-2025-23426

CVE-2025-23426: Red Hat and NVD reference CSRF in Wizcrew Technologies go Social that enables Stored XSS. Affected: go Social (n/a to 1.0). Root cause: cross-site request forgery allows attacker-supplied data to be stored and reflected, yielding stored XSS in vulnerable contexts. Exploitation det...

PT-2025-2943 · Imagination Technologies · Imagination Technologies Graphics Ddk

Name of the Vulnerable Software and Affected Versions: Imagination Technologies Graphics DDK version = 24.2 RTM2 Description: The kernel software installed and running inside a Guest VM may send improper commands to the GPU Firmware to subvert reconstruction activities and trigger a write of data...

PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file

Unauthorized Reflected XSS in the Accounting.php file Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 8.2 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS vector v.4.0: 8.3...

Amcrest Technologies IP Camera Information Disclosure Vulnerability (Dec 2024) - Active Check

Multiple Amcrest Technologies IP Cameras are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Arctera Data Insight 安全漏洞

Arctera Data Insight is a data management software from Veritas Technologies. A security vulnerability exists in Arctera Data Insight versions prior to 7.1.1. An attacker exploiting this vulnerability could perform a SQL injection attack...

File Upload Vulnerability in H3C Intelligent Management Center of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is a global leader in digital solutions. A file upload vulnerability exists in the H3C Intelligent Management Center of Xinhua San Technologies Limited, which can be exploited by an attacker to gain control of the server...

The vulnerability of Imagination Technologies’ component in the Android operating system allows a hacker to increase their privileges and gain full access to the device.

The vulnerability of Imagination Technologies’ Android operating system component relates to insecure privilege management. Exploiting this vulnerability can allow attackers to enhance their privileges and gain full access to the device...

PT-2024-70: Buffer Overflow in Suricata

The vulnerability was identified in Suricata versions 7.0.7 and below. Failure to check the input file size may result in a buffer overflow. Possible consequences of exploiting the vulnerability include an attacker gaining remote access to configuration files, injection a malicious BPF file into...

MC LR Router and GoCast unpatched vulnerabilities

Cisco Talos' Vulnerability Research team recently discovered two vulnerabilities in MC Technologies LR Router and three vulnerabilities in the GoCast service. These vulnerabilities have not been patched at time of this posting. For Snort coverage that can detect the exploitation of these...

CVE-2024-8259

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was...

CVE-2024-8259 Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was...

CVE-2024-8259

The CVE-2024-8259 entry concerns an SQL Injection in Eryaz Information Technologies’ NatraCar B2B Dealer Management Program. The issue stems from improper neutralization of special elements in SQL commands, enabling unauthenticated SQL injection prior to an end-of-life date (through 09.12.2024). ...

CVE-2024-8259 Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was...

CVE-2024-54228

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-elementor-widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through = 1.0.1...