CVE-2025-10452 Gotac｜Statistical Database System - Missing Authentication

Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level privileges...

PT-2025-37454

Name of the Vulnerable Software and Affected Versions: O'View MapServer affected versions not specified Description: O'View MapServer developed by PilotGaea Technologies contains a Server-Side Request Forgery vulnerability. This allows unauthenticated remote attackers to probe internal networks...

CVE-2025-9880

The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

CVE-2025-9620

The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorrect nonce validation on the checkintegration function. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-9635

The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the unbounceoptions function. This makes it possible for unauthenticated attackers to modify Google...

CVE-2025-9634

The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pubsave action handler. This makes it possible for unauthenticated attackers to disable or enable plug...

CVE-2025-10264

CVE-2025-10264 — Digiever NVR exposure of sensitive information . Multiple connected sources confirm that certain Digiever NVR models are vulnerable to an exposure of sensitive information, allowing unauthenticated remote attackers to access the system configuration file and obtain plaintext cred...

CVE-2025-9881

CVE-2025-9881 (Ultimate Blogroll, WordPress) : The WordPress plugin Ultimate Blogroll (≤ 2.5.2) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in a function. This can allow unauthenticated attackers to update plugin settings and inject malicious scripts via ...

CVE-2025-9880 Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

NewType Infortech NUP Portal 访问控制错误漏洞

NewType Infortech NUP Portal is a portal management and collaborative office software system from NewType Infortech Taiwan, China. An access control error vulnerability exists in NewType Infortech NUP Portal, which stems from a lack of authentication and could allow an unauthenticated remote...

PT-2025-37301

Name of the Vulnerable Software and Affected Versions: NUP Pro affected versions not specified Description: NUP Pro developed by NewType Infortech has a SQL Injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands. Successful exploitation can lead to t...

CVE-2025-9633

The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect nonce validation on the pluginoptions function. This makes it possible for unauthenticated attackers to modify plugin settings via a forg...

CVE-2025-9623

The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the enableeng function. This makes it possible for unauthenticated attackers to modify administrator...

CVE-2025-9633

CVE-2025-9633: LH Signing WordPress plugin vulnerabilities exist in all versions up to 2.83 due to missing or incorrect nonce validation in the plugin_options function, enabling CSRF. This allows unauthenticated attackers to modify plugin settings by inducing an admin action (e.g., clicking a for...

CVE-2025-9634

CVE-2025-9634 concerns the WordPress plugin “Plugin updates blocker” (versions up to and including 0.2). The flaw is a CSRF vulnerability caused by missing or incorrect nonce validation on the pub_save action, enabling unauthenticated attackers to toggle plugin updates (disable/enable) by luring ...

CVE-2025-9635

CVE-2025-9635 affects the Analytics Reduce Bounce Rate plugin for WordPress (versions up to 2.3). The flaw is a Cross-Site Request Forgery due to missing or incorrect nonce validation on the unbounce_options function, enabling unauthenticated attackers to modify Google Analytics tracking settings...

CVE-2025-9631 AutoCatSet <= 2.1.4 - Cross-Site Request Forgery

The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatsetajax function. This makes it possible for unauthenticated attackers to trigger automatic...

PT-2025-37133

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.20. This makes it possible for unauthenticat...

PT-2025-37140

Name of the Vulnerable Software and Affected Versions: All in one Minifier plugin for WordPress versions prior to 3.3 Description: The All in one Minifier plugin for WordPress is susceptible to SQL Injection due to insufficient escaping of the post id parameter and inadequate preparation of...

PT-2025-37153

The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the unbounce options function. This makes it possible for unauthenticated attackers to modify Google...