WordPress Appzend theme <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via progressbarLayout Parameter vulnerability discovered by Peter Thaleikis in WordPress Theme Appzend versions = 1.2.6...

WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Plugin Atarim versions = 4.2.1...

WordPress Finale Lite Plugin <= 2.20.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by LVT-tholv2k in WordPress Plugin Finale Lite versions = 2.20.0...

GitLab Language Server 访问控制错误漏洞

GitLab Language Server is a language server from GitLab USA. An access control error vulnerability exists in GitLab Language Server versions prior to 7.6.0 through 7.30.0 that stems from insufficient input validation and could lead to arbitrary GraphQL query execution...

Lobby Universe Lobby App 安全漏洞

Lobby Universe Lobby App is a random video calling app from Lobby Universe, Inc. in the United States. A security vulnerability exists in Lobby Universe Lobby App version 2.8.0 and earlier, which stems from an improperly exported AndroidManifest.xml component...

WordPress WoodMart - Multipurpose WooCommerce Theme plugin <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation vulnerability

WordPress WoodMart - Multipurpose WooCommerce Theme plugin = 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation vulnerability discovered by Samir El Khaouti in WordPress Theme WoodMart versions = 8.2.6...

UBUNTU-CVE-2025-38376

In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume Shawn and John reported a hang issue during system suspend as below: - USB gadget is enabled as Ethernet - There is data transfer over USB Ethernet scp a b...

WordPress Simple Contact Forms plugin <= 1.6.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Simple Contact Forms versions = 1.6.4...

WordPress Saxon - Viral Content Blog & Magazine Marketing WordPress Theme theme <= 1.9.3 - Local File Inclusion vulnerability

WordPress Saxon - Viral Content Blog & Magazine Marketing WordPress Theme theme = 1.9.3 - Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Saxon - Viral Content Blog & Magazine Marketing WordPress Theme versions = 1.9.3...

CLSA-2025-1753085842 Fix of 10 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-46787 - userfaultfd: fix checks for huge PMDs CVE-url: https://ubuntu.com/security/CVE-2025-37798 - schhtb: make htbqlennotify idempotent - schdrr: make drrqlennotify idempotent - schhfsc: make hfscqlennotify idempotent - schqfq: make qfqqlennotify...

CVE-2025-7887 Zavy86 WikiDocs template.inc.php cross site scripting

A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc.php. The manipulation of the argument path leads to cross site scripting. The attack can be initiated remotely. The exploit has been...

WordPress LeadBI Plugin for WordPress plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin LeadBI Plugin for WordPress versions = 1.7...

CVE-2025-54018

Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through = 1.8.4...

CVE-2025-53995

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetPopup jet-popup allows Stored XSS.This issue affects JetPopup: from n/a through = 2.0.15.1...

Gnuboard 代码注入漏洞

Gnuboard is a suite of extensible forum programs from the Gnuboard open source. A code injection vulnerability exists in Gnuboard g6 6.0.10 and earlier versions, which stems from a cross-site scripting attack due to misuse of the component Post Reply Handler...

CVE-2025-34121

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The wizards/post2file.php script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in...

CVE-2025-30949

Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat on Telegram: from n/a through = 1.0.4...

CVE-2025-49876 WordPress ProfileGrid <= 5.9.5.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid allows SQL Injection. This issue affects ProfileGrid : from n/a through 5.9.5.2...

CVE-2025-52787 WordPress Tennis Court Bookings plugin <= 1.2.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EZiHosting Tennis Court Bookings allows Reflected XSS. This issue affects Tennis Court Bookings: from n/a through 1.2.7...

CVE-2025-54026

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in QuanticaLabs GymBase Theme Classes gymbaseclasses allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through = 1.4...