CVE-2022-35192

D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service DoS via the User parameter or Pwd parameter to Login.asp...

EUVD-2024-47000

Malicious code in bioql PyPI...

EUVD-2024-32141

Malicious code in bioql PyPI...

EUVD-2024-49481

Malicious code in bioql PyPI...

EUVD-2025-4921

Malicious code in bioql PyPI...

EUVD-2024-49645

Malicious code in bioql PyPI...

EUVD-2024-48536

Malicious code in bioql PyPI...

EUVD-2024-33647

Malicious code in bioql PyPI...

CVE-2025-2800

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizername' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This...

CVE-2025-48757

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a...

CVE-2024-12176

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wlconfigplugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2024-11458

The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'aysfaqtab' parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2025-27561

CVE-2025-27561 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources identify unauthenticated attackers can rename the target user’s “rooms,” with associated risk of unauthorized changes to user data and device groupings. Public records point to Growatt Cloud Appli...

CVE-2025-2578

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web...

CVE-2024-10829

A Denial of Service DoS vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading...

CVE-2025-1262 Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass

The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification...

CVE-2025-1387

CVE-2025-1387 affects Orca HCM from LEARNING DIGITAL. The connected sources describe an improper authentication vulnerability that allows unauthenticated remote attackers to log in as any user, indicating a severe impact (high confidentiality, integrity, and availability) per the CVSS vector: AV:...

CVE-2024-3600

The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ayspollmakerquickstart AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes i...

CVE-2024-13234 Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection

The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

About Authentication Bypass – Hunk Companion WordPress plugin (CVE-2024-11972) vulnerability

About Authentication Bypass - Hunk Companion WordPress plugin CVE-2024-11972 vulnerability. ThemeHunk company develops commercial themes for WordPress CMS. And the Hunk Companion plugin is designed to complement and enhance the functionality of these themes. The plugin has over 10,000...