11795 matches found
PT-2025-38904
Name of the Vulnerable Software and Affected Versions Chandrika Sista WP Category Dropdown versions through 1.9 Description The software contains a flaw related to improper input handling during web page creation, specifically a Stored Cross-Site Scripting issue. This allows for the injection of...
WordPress SEO Pyramid plugin <= 1.9.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin SEO Pyramid versions = 1.9.8...
WordPress Likert Survey Master plugin <= 0.8.0.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Likert Survey Master versions = 0.8.0.1...
CVE-2025-9887
CVE-2025-9887 concerns the WordPress plugin Custom Login And Signup Widget . The vulnerability is a Cross-Site Request Forgery in all versions up to 1.0 caused by missing or incorrect nonce validation in the file /frndzk_adminclsw.php. This allows unauthenticated attackers to change email and use...
CVE-2025-10002
CVE-2025-10002 affects the ClickWhale – Link Manager, Link Shortener and Click Tracker for WordPress plugin. Versions up to and including 2.5.0 are vulnerable to SQL Injection in export_csv() due to insufficient escaping and lack of proper query preparation, enabling authenticated Administrators ...
CVE-2025-10181 Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
WordPress osTicket WP Bridge plugin <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin osTicket WP Bridge versions = 1.9.2...
WordPress Author: Munzir plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Author: Munzir versions = 0.9...
PT-2025-38309
Name of the Vulnerable Software and Affected Versions ABB FLXEON versions through 9.3.5 Description An improper input validation issue exists in ABB FLXEON, potentially leading to remote code execution. Recommendations Update to a version later than 9.3.5...
SUSE CVE-2023-53240
In the Linux kernel, the following vulnerability has been resolved: xsk: check IFFUP earlier in Tx path Xsk Tx can be triggered via either sendmsg or poll syscalls. These two paths share a call to common function xskxmit which has two sanity checks within. A pseudo code example to show the two...
GHSA-J424-MC44-F4HJ Duplicate Advisory: Picklescan Bypass is Possible via File Extension Mismatch
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jgw4-cr84-mqxg. This link is maintained to preserve external references. Original Description An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and includin...
CVE-2025-10057
CVE-2025-10057 details from multiple sources confirm a Remote Code Execution flaw in the WordPress plugin “WP Import – Ultimate CSV XML Importer for WordPress” up to version 7.28. The root cause is unfiltered PHP code being written by write_to_customfile(), enabling an authenticated user with Sub...
WordPress StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download vulnerability
Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by Ryan Kozak in WordPress Plugin StoreEngine versions = 1.5.0...
SUSE CVE-2022-50247
In the Linux kernel, the following vulnerability has been resolved: usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq Can not set the @sharedhcd to NULL before decrease the usage count by usbputhcd, this will cause the shared hcd not released...
WordPress USS Upyun plugin <= 1.5.0 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Claw.k in WordPress Plugin USS Upyun versions = 1.5.0...
CVE-2023-53330 caif: fix memory leak in cfctrl_linkup_request()
In the Linux kernel, the following vulnerability has been resolved: caif: fix memory leak in cfctrllinkuprequest When linktype is unknown or kzalloc failed in cfctrllinkuprequest, pkt is not released. Add release process to error path...
How to Set Up and Use a Burner Phone
Obtaining and using a true burner phone is hard—but not impossible. Here are the steps you need to take to protect your mobile communications based on the risks you face...
WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Abu Hurayra in WordPress Plugin Accordion versions = 2.3.14...
CVE-2023-53280
CVE-2023-53280 affects the Linux kernel’s scsi/qla2xxx path. The issue stems from removing the unused nvme_ls_waitq wait queue, which could lead to a NULL pointer dereference when qla2x00_start_sp returns an error and wake_up is invoked for an uninitialized sp->nvme_ls_waitq. The connected adv...
PT-2025-38048
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak was identified in the cfctrl linkup request function within the caif module of the Linux kernel. Specifically, when the link type is unknown or memory allocation via...