CVE-2025-12633

CVE-2025-12633 : The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable due to a missing capability check on the REST endpoint /wp-json/bookit/v1/commerce/stripe/return, affecting all versions up to and including 2.5.0. This allows unauthenticated attackers to conn...

CVE-2025-12901

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12588

The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings...

PT-2025-46572

Name of the Vulnerable Software and Affected Versions aEnrich a+HRD affected versions not specified Description The software contains an Authentication Abuse issue that allows unauthenticated remote attackers to send crafted packets to obtain administrator access tokens. These tokens can then be...

CVE-2025-24834

Protection mechanism failure for some IntelR CIP software before version WINDCA2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result...

EUVD-2025-60951

The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

EUVD-2025-60975

The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.0 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files...

CVE-2025-11891

The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files...

CVE-2025-12868

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

PT-2025-46264

Name of the Vulnerable Software and Affected Versions Shelf Planner versions 2.7.0 and earlier Description The Shelf Planner plugin for WordPress has a flaw that could expose sensitive information. This is due to publicly exposed log files, potentially allowing unauthenticated attackers to view...

CVE-2025-12868

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

CVE-2025-12868

CVE-2025-12868 : The vulnerability affects CyberTutor’s New Site Server. Affected component is the client-side authentication mechanism, where unauthenticated remote attackers can modify frontend code and potentially gain administrator privileges on the website. Documented impact includes full ad...

EUVD-2025-41750

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

CVE-2025-12868 CyberTutor｜New Site Server - Use of Client-Side Authentication

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

CVE-2025-12868 CyberTutor｜New Site Server - Use of Client-Side Authentication

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

CVE-2025-12866 Hundred Plus｜EIP Plus - Weak Password Recovery Mechanism

EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password...

PT-2025-45594

Name of the Vulnerable Software and Affected Versions New Site Server affected versions not specified Description New Site Server, developed by CyberTutor, is affected by a Use of Client-Side Authentication issue. This allows unauthenticated remote attackers to modify the frontend code, potential...

PT-2025-45591

Name of the Vulnerable Software and Affected Versions Hundred Plus EIP Plus affected versions not specified Description The software contains a Weak Password Recovery Mechanism, allowing unauthenticated remote attackers to predict or brute-force the 'forgot password' link or token. Successful...

CVE-2025-12352

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

CVE-2025-7663

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files,...