CVE-2025-7642: Authentication Bypass Using an Alternate Path or Channel

The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwcwoocommerceordercreated function. This makes it possible for...

CVE-2025-9229: Generation of Error Message Containing Sensitive Information

Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages...

CVE-2025-8878: Improper Control of Generation of Code

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.4. This is due to the software allowing users to execute an...

CVE-2025-50690: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in SpatialReference.org OSGeo/spatialreference.org versions prior to 2025-05-17 commit 2120adfa17ddd535bd0f539e6c4988fa3a2cb491. The vulnerability is caused by improper handling of user input in the search query parameter. An attacker can craft a...

PT-2025-32964

Name of the Vulnerable Software and Affected Versions: OceanWP versions 4.0.9 through 4.1.1 Description: The OceanWP theme for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation within the oceanwp notice button click function. This allows unauthenticated...

CVE-2025-5462

Ivanti vulnerability CVE-2025-5462 is a heap-based buffer overflow affecting Ivanti Connect Secure prior to 22.7R2.8 or 22.8R2, Ivanti Policy Secure prior to 22.7R1.5, Ivanti ZTA Gateway prior to 22.8R2.3-723, and Ivanti Neurons for Secure Access prior to 22.8R1.4. The flaw allows a remote unauth...

CVE-2025-54992: Improper Restriction of XML External Entity Reference

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity XXE injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is...

CVE-2025-52913: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP2 9.8.2.12 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to...

CVE-2025-7054

Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRECONNECTIONID frames. QUIC connections possess a set of connection identifiers IDs; see Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000section-5.1 . Once the QUIC...

CVE-2025-7036

CVE-2025-7036 affects the CleverReach WordPress plugin (CleverReachWP) for WordPress, with unauthenticated, time-based SQL injection via the title parameter in all versions up to 1.5.20. Root cause: insufficient escaping of user input and insufficient preparation of the existing SQL query. Impact...

CVE-2025-51628: Authorization Bypass Through User-Controlled Key

Insecure Direct Object Reference IDOR vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter...

CVE-2025-38739: Insufficiently Protected Credentials

Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2025-54834

OPEXUS FOIAXpress Public Access Link PAL version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place...

CVE-2025-6832: Improper Neutralization of Input During Web Page Generation

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2025-7725 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to...

CVE-2025-54834 OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration

OPEXUS FOIAXpress Public Access Link PAL version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place...

CVE-2025-5720

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-5720

The CVE-2025-5720 entry concerns the WordPress plugin “Customer Reviews for WooCommerce.” It is an unauthenticated stored XSS via the author parameter in all versions up to 5.80.2. The vulnerability arises from insufficient input sanitization and output escaping, allowing an attacker to inject ar...

PT-2025-31567 · Opexus · Opexus Foiaxpress Public Access Link

Name of the Vulnerable Software and Affected Versions: OPEXUS FOIAXpress Public Access Link PAL version v11.1.0 Description: OPEXUS FOIAXpress Public Access Link PAL version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence...

CVE-2023-2593

A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This vulnerability allows an unauthenticated attacker to create a denial of service condition on the system...