11787 matches found
CVE-2025-64239 WordPress RTL Tester plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a through = 1.2...
CVE-2025-59001
The CVE-2025-59001 is a Missing Authorization vulnerability in ThemeNectar Salient Core (WordPress plugin) affecting Salient Core up to version 3.0.8. The issue stems from incorrectly configured access control security levels, enabling unauthorized access due to insufficient privilege checks. Pub...
CVE-2025-59001 WordPress Salient Core plugin <= 3.0.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through = 3.0.8...
CVE-2025-54004 WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability
Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through = 6.7.24...
CVE-2025-49300
CVE-2025-49300 affects WordPress plugin Traveler Option Tree (shinetheme) up to version 2.8. The vulnerability arises from insertion of sensitive information into data that is sent, enabling retrieval of embedded sensitive data from the custom-option-tree component. Affected versions are through ...
CVE-2025-11991 JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the runcallback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate form...
PT-2025-51712
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the kvaser usb leaf wait cmd and kvaser usb leaf read bulk callback functions related to handling zero-length commands used for aligning data to U...
PT-2025-51429
Name of the Vulnerable Software and Affected Versions Lottier for Elementor versions through 1.0.9 Description An issue exists in Lottier for Elementor related to incorrectly configured access control security levels, allowing for missing authorization. The issue allows exploitation of access...
PT-2025-51467
Name of the Vulnerable Software and Affected Versions Merkulove Huger for Elementor versions through 1.1.5 Description The software contains a missing authorization issue due to incorrectly configured access control security levels. Recommendations Update Merkulove Huger for Elementor to a versio...
PT-2025-51392
Name of the Vulnerable Software and Affected Versions Restrict Elementor Widgets, Columns and Sections versions through 1.12 Description The Restrict Elementor Widgets, Columns and Sections software contains a missing authorization issue. This allows exploitation due to incorrectly configured...
PT-2025-51423
Name of the Vulnerable Software and Affected Versions Coder for Elementor versions through 1.0.13 Description An issue exists in Coder for Elementor that relates to incorrectly configured access control security levels, potentially allowing unauthorized access. The vulnerability involves a missin...
PT-2025-51461
Cross-Site Request Forgery CSRF vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through = 1.1.32...
PT-2025-51447
Name of the Vulnerable Software and Affected Versions LambertGroup LBG Zoominoutslider versions through 5.4.5 Description A flaw exists in LambertGroup LBG Zoominoutslider that allows for SQL Injection. This occurs due to improper neutralization of special elements used in an SQL command. The iss...
Mercury D196G 安全漏洞
The Mercury D196G is a wireless router from Mercury China. A security vulnerability exists in the Mercury D196G d196gv1-cn-up2020-01-0911.21.44 version, which stems from improper handling of the facpassword parameter, which could lead to a buffer overflow...
PT-2025-51443
Name of the Vulnerable Software and Affected Versions Stefano Lissa Newsletter versions through 9.0.9 Description A flaw exists in Stefano Lissa Newsletter that allows for Blind SQL Injection due to Improper Neutralization of Special Elements used in an SQL Command. This issue could potentially...
PT-2025-51387
Name of the Vulnerable Software and Affected Versions Yoav Farhi RTL Tester versions through 1.2 Description A Cross-Site Request Forgery CSRF issue exists in Yoav Farhi RTL Tester. This allows attackers to potentially perform actions on behalf of an authenticated user without their knowledge. Th...
PT-2025-51417
Name of the Vulnerable Software and Affected Versions Pochipp versions through 1.18.0 Description An authorization issue exists in Pochipp pochipp, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update Pochipp to a version later than 1.18.0...
CVE-2025-14383 Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check
The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'datestocheck' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2025-65782
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members and potentially other authenticated users to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vo...
