11799 matches found
CVE-2025-49434
Deserialization of Untrusted Data vulnerability in axiomthemes Cars4Rent cars4rent allows Object Injection.This issue affects Cars4Rent: from n/a through = 1.4.2...
CVE-2025-49438
Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through 1.1.3...
CVE-2025-28977
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThimPress WP Pipes allows Reflected XSS. This issue affects WP Pipes: from n/a through 1.4.3...
CVE-2025-48171
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Cena Store cena allows PHP Local File Inclusion.This issue affects Cena Store: from n/a through = 2.11.26...
CVE-2025-53205
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a through = 4.4.7...
CVE-2025-48164
Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through = 1.0.3...
CVE-2024-52786
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL...
CVE-2022-31491
Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can use this t...
IBM QRadar SIEM 安全漏洞
IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...
Cherry pie, Douglas firs and the last trip of the summer
Welcome to this week's edition of the Threat Source newsletter. Diane, 2:01 p.m., August 21st. I've just returned from a remarkable journey through Seattle and the misty roads of the Olympic Peninsula. If you ever find yourself driving beneath those towering Douglas firs or dragged by your partne...
WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WPMU Ldap Authentication versions = 5.0.1...
WordPress e-Boekhouden.nl Plugin <= 1.9.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Skalucy in WordPress Plugin e-Boekhouden.nl versions = 1.9.3...
WordPress Magazine Elite Theme <= 1.2.4 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Le Ngoc Anh in WordPress Theme Magazine Elite versions = 1.2.4...
WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Bonds in WordPress Theme Organic Beauty versions = 1.4.6...
WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability
Broken Authentication Vulnerability discovered by Rau má đậu xanh in WordPress Theme Golo versions = 1.7.0...
WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability
Broken Authentication Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jobmonster versions = 4.7.9...
CVE-2025-52352
Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to...
PT-2025-34227 · WordPress · An-Themes Pin Wp
Name of the Vulnerable Software and Affected Versions: An-Themes Pin WP versions prior to 7.2 An-Themes Pin WP versions through 6.9 Description: An unrestricted file upload vulnerability exists in An-Themes Pin WP, allowing for the upload of web shells to a web server. This could lead to full...
WordPress Golo Theme <= 1.7.0 is vulnerable to Broken Authentication
Software Golo Type Theme Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-54725 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID a2ab39e8e113 Credits Aiden Required...
CVE-2025-52352
CVE-2025-52352 affects Aikaan IoT management platform version 3.25.0325-5-g2e9c59796. The UI can hide the sign-up option, but the signup API remains publicly accessible, allowing unauthenticated account creation and leading to authentication bypass and unauthorized admin portal access. Connected ...