CVE-2025-47786

CVE-2025-47786 affects Emlog 2.5.13. The vulnerability is a stored cross-site scripting issue in /admin/comment.php where the unvalidated parameter perpage_num is stored in the database (admin_commend_perpage_num) and the output is not filtered, allowing a registered user to inject JavaScript tha...

CVE-2025-46655

CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...

CVE-2025-46452 WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1...

DEBIAN-CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

AZL-61768 CVE-2024-58250 affecting package ppp 2.5.0-1

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

MindSpore 缓冲区错误漏洞

MindSpore is a new open source deep learning training/inference framework open sourced by MindSpore. It can be used in mobile, edge and cloud scenarios. A buffer error vulnerability exists in MindSpore version 2.5.0 that stems from a memory corruption...

VulnCheck KEV: CVE-2025-2294

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubiohybridthemeloadtemplate function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing...

Apache VCL SQL Injection Vulnerability

Apache VCL is a set of open source cloud computing platform of the American Apache Apache Foundation. An SQL injection vulnerability exists in Apache VCL versions 2.2 to 2.5.1, which stems from improper neutralization of special elements in SQL commands, and can be exploited by an attacker to cau...

WordPress Product Import Export for WooCommerce plugin <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function vulnerability

Authenticated Administrator+ Server-Side Request Forgery via validatefile Function vulnerability discovered by HayMiz in WordPress Plugin Product Import Export for WooCommerce versions = 2.5.0...

GnuPG 安全漏洞

GnuPG is a suite of open source cryptographic software from the American GNU community under the GNU General Public License. The software supports public key, symmetric encryption, hashing, and other algorithms. A security vulnerability exists in GnuPG versions prior to 2.5.5, which stems from th...

WordPress No Disposable Email plugin <= 2.5.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin No Disposable Email versions = 2.5.1...

GHSA-P34J-R3CH-C985 Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI. This allows attackers with Agent/Extended Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted...

CVE-2025-25818

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...

CVE-2025-25823

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25823

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

WordPress Web Accessibility By accessiBe plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Web Accessibility By accessiBe versions = 2.5...

PT-2025-6534 · WordPress · Wp Directorybox Manager

Name of the Vulnerable Software and Affected Versions: WP Directorybox Manager plugin for WordPress versions up to, and including, 2.5 Description: The issue is due to incorrect authentication in the wp dp parse request function, allowing unauthenticated attackers to log in as any existing user o...

WordPress Simple Google Calendar Outlook Events Block Widget plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis Patchstack Alliance in WordPress Plugin Simple Google Calendar Outlook Events Block Widget versions = 2.5.0...