11799 matches found
WordPress Jina - Celebration Agency Theme Theme <= 1.6 - Deserialization of untrusted data Vulnerability
WordPress Jina - Celebration Agency Theme Theme = 1.6 - Deserialization of untrusted data Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jina - Celebration Agency Theme versions = 1.6...
WordPress Golo Theme <= 1.7.1 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Bonds in WordPress Theme Golo versions = 1.7.1...
CVE-2025-6247
CVE-2025-6247 affects the WordPress Automatic Plugin for WordPress (
WordPress Rozario Theme <= 1.4 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Rozario versions = 1.4...
HPESBHF04911 rev.1 - HPE Compute Scale-up Server 3200 Platform Servers using Certain Intel Processors, INTEL-SA-01313, 2025.3 IPU, Intel Xeon Processor Firmware Advisory, Multiple Vulnerabilities
Potential Security Impact: Local: Denial of Service DoS, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.60.88 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-20053 |...
SUSE CVE-2025-38617
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packetsetring and packetnotifier When packetsetring releases po-bindlock, another thread can run packetnotifier and process an NETDEVUP event. This race and the fix are both similar to that of commit...
CVE-2025-9416 oitcode samarium Pages Image webpage cross site scripting
A security flaw has been discovered in oitcode samarium up to 0.9.6. This vulnerability affects unknown code of the file /cms/webpage/ of the component Pages Image Handler. The manipulation results in cross site scripting. The attack may be performed from a remote location. The exploit has been...
CVE-2025-57811
Craft CMS vulnerability CVE-2025-57811 is a remote code execution via Twig SSTI affecting Craft 4.x (4.0.0-RC1 through 4.16.5) and 5.x (5.0.0-RC1 through 5.8.6). The issue stems from Twig SSTI and is a follow-up to CVE-2024-52293. Affected versions are patched in Craft 4.16.6 and 5.8.7. If you ru...
CVE-2025-57811 Craft Potential Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI Server-Side Template Injection. This is a follow-up to CVE-2024-52293. This vulnerability has been patched in...
CVE-2025-57811 Craft Potential Remote Code Execution via Twig SSTI
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI Server-Side Template Injection. This is a follow-up to CVE-2024-52293. This vulnerability has been patched in...
WordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Employee Spotlight versions = 5.1.1...
CVE-2025-9407
CVE-2025-9407 affects mtons mblog up to version 3.5.0. The vulnerability lies in an unknown functionality of the file /settings/profile where manipulation of the signature parameter can trigger cross-site scripting. Exploitation is possible remotely. A fixed version is not present in the affected...
CVE-2025-48303
CVE-2025-48303 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Post Type Converter (versions up to 0.6). The entry lists a CVSS v3.1 base score of 4.3 (Medium) with vectors: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Connected sources corroborate the CSRF flaw and no...
CVE-2025-9131
The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...
CVE-2025-9406
A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...
AZL-66678 CVE-2025-9403 affecting package jq for versions less than 1.6-5
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function runjqtests of the file jqtest.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Othe...
WordPress Responsive Mobile-Friendly Tooltip plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Responsive Mobile-Friendly Tooltip versions = 1.6.6...
CVE-2025-9396
CVE-2025-9396 affects lrzip up to version 0.651 (ckolivas). The vulnerability targets __GI_____strtol_l_internal in strtol_l.c, where input manipulation can cause a null pointer dereference. Exploitation requires local access; public exploits exist. No vendor patch/version is provided in the avai...
CVE-2025-9391 Bjskzy Zhiyou ERP com.artery.workflow.ServiceImpl getFieldValue sql injection
A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made...