CVE-2025-10504

Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33...

CVE-2025-6396

CVE-2025-6396 affects Webbeyaz Website Design Website Software (versions through 2025.07.14). The root cause is improper neutralization of input during web page generation, leading to cross-site scripting (XSS). The CVSS–3.1 vector indicates NETWORK access, LOW attack complexity, no privileges re...

CVE-2025-60219

Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through = 1.9.24...

PT-2025-39561

Name of the Vulnerable Software and Affected Versions YayCommerce YayCurrency versions through 3.2 Description A code injection issue exists in YayCommerce YayCurrency. The flaw is due to improper control of code generation. Successful exploitation could allow attackers to inject and execute...

CVE-2025-60094: Missing Authorization

Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through = 3.18.1...

CVE-2025-58960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through = 2.4.3...

CVE-2025-57936

Missing Authorization vulnerability in Meitar Subresource Integrity SRI Manager wp-sri allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subresource Integrity SRI Manager: from n/a through = 0.4.0...

CVE-2025-57924

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6...

CVE-2025-58968

Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MaxiBlocks: from n/a through = 2.1.3...

CVE-2025-58200

Cross-Site Request Forgery CSRF vulnerability in Bage Flexible FAQ flexible-faq allows Cross Site Request Forgery.This issue affects Flexible FAQ: from n/a through = 0.2...

CVE-2025-57907

CVE-2025-57907 is a Missing Authorization vulnerability affecting the Heureka WordPress plugin. The initial description states an unauthenticated user could access functionality not properly constrained by ACLs, impacting versions up to 1.1.0. The connected Wordfence vulnerability report corrobor...

CVE-2025-53692 Sitecore Experience Platform Cross-Site Scripting Vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sitecore Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Cross-Site Scripting XSS.This issue affects Sitecore Experience Manager XM: from 9.2 through 10.4; Experience...

CVE-2024-48851

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This issue affects FLXEON: through 9.3.5...

PT-2025-38304

Name of the Vulnerable Software and Affected Versions Paraşüt Software Bizmu versions 2.27.0 through 20250212 Description This issue allows for Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations Paraşüt Software Bizmu versions 2.27.0 throu...

CVE-2024-13174

CVE-2024-13174 is an SQL Injection in the E1 Informatics Web Application caused by improper neutralization of special elements in SQL commands. Affected versions are through 20250916. The CVSS 3.1 base score is 8.6 (High) with NETWORK attack vector, no privileges required, no user interaction. Im...

CVE-2024-13174

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in E1 Informatics Web Application allows SQL Injection. This issue affects Web Application: through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the...

CVE-2024-12796 Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive...

PT-2025-37922

Name of the Vulnerable Software and Affected Versions: Megatek Communication System Azora Wireless Network Management versions through 20250916 Description: The software contains an SQL injection flaw due to improper neutralization of special elements used in an SQL command. This allows for SQL...

CVE-2024-12367: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issue affects Vega Master: from v.1.12.35 through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within...

Samsung Fixes Critical Zero-Day CVE-2025-21043 Exploited in Android Attacks

Samsung has released its monthly security updates for Android, including a fix for a security vulnerability that it said has been exploited in zero-day attacks. The vulnerability, CVE-2025-21043 CVSS score: 8.8, concerns an out-of-bounds write that could result in arbitrary code execution...