CVE-2024-13684

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

GHSA-VXM9-8MFW-VC6G Hermes improperly validates a JWT

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...

PT-2025-7294 · Phpjabbers · Phpjabbers Car Park Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Car Park Booking System version 3.0 Description: The issue is related to a CSV injection vulnerability that allows an attacker to execute remote code. This vulnerability exists due to insufficient input validation in the Languages...

RHEL 8 : postgresql:13 (RHSA-2025:1736)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1736 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL quoting APIs miss neutralizing...

Important: libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 For more details about the security...

CVE-2023-51324

PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV...

The vulnerability of the AmdPspP2CmboxV2 driver of AMD’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the AmdPspP2CmboxV2 microprogramming software driver for AMD processors is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2024-5706

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. CWE-99 Hitachi Vantara Pentaho Data Integration & Analytics versions before...

CVE-2023-51298

PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file...

CVE-2025-20211

CVE-2025-20211 describes a cross-site scripting vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform. The flaw arises from improper validation of user-supplied input, enabling an unauthenticated, remote attacker to persuade a user to click a crafte...

FeMiner wms id parameter SQL injection vulnerability

FeMiner wms is a warehouse management system for Chinese front-end miners FeMiner individual developers. A SQL injection vulnerability exists in FeMiner wms version 1.0, which stems from the lack of validation of the date1, date2, id parameters against externally entered SQL statements. An attack...

YesWiki cross-site scripting vulnerability (CNVD-2025-03330)

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A cross-site scripting vulnerability exists in YesWiki 4.4.5 and earlier versions, which stems from improper input validation when the attach component...

CVE-2025-25305 SSL validation for outgoing requests in Home Assistant Core and used libs not correct

Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

CVE-2024-13691 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncoderecordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary...

CVE-2024-13691

CVE-2024-13691 affects Uncode (WordPress)

CVE-2024-13681 Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncodeadmingetoembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated attackers to read arbitrary files on the server...

CVE-2024-12860

CVE-2024-12860 refers to the CarSpot – Dealership WordPress Classified Theme. The vulnerability allows unauthenticated privilege escalation via account takeover because the plugin does not properly validate a token before updating a user’s password. The issue affects CarSpot up to and including v...

CVE-2024-13718

CVE-2024-13718 concerns the WordPress plugin “Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later” (up to version 1.2.26). The vulnerability is a Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on multiple functions, enabling unauthenticated atta...

CVE-2024-13795 Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27. This is due to missing or incorrect nonce validation on the ecwiddeactivatefeedback function. This makes it possible for unauthenticated...

CVE-2024-13795

CVE-2024-13795 affects Ecwid by Lightspeed Ecommerce Shopping Cart for WordPress. Vulnerability: Cross-Site Request Forgery due to missing/incorrect nonce validation in ecwid_deactivate_feedback(). Impact: unauthenticated attacker can trigger deactivation messages on behalf of the site owner by d...