CVE-2025-52808 WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in real-web RealtyElite realtyelite allows PHP Local File Inclusion.This issue affects RealtyElite: from n/a through = 1.0.0...

WordPress plugin Hide Admin Bar From Front End 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in WordPress...

WordPress plugin RealtyElite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin CTUsers 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-6290

The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Theme RealtyElite versions = 1.0.0...

Malicious code in fooldepend9f218a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2d68aea54197ae7455406cdcc725402bd69770cce80a8958ec4d1627b67a2814 The OpenSSF Package Analysis project identified 'fooldepend9f218a' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Hope-Boot 安全漏洞

Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. A security vulnerability exists in Hope-Boot version 1.0.0, which stems from the mishandling of the parameter errorMsg by the Login function in WebController.java, which could lead to a cross-site scripting attack...

CVE-2025-52794

Cross-Site Request Forgery CSRF vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through = 1.0.0...

CVE-2025-52794 WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through = 1.0.0...

PT-2025-26218 · Unknown · Zhilink Adp Application Developer Platform

Name of the Vulnerable Software and Affected Versions: zhilink ADP Application Developer Platform version 1.0.0 Description: A critical issue affects the processing of the file /adpweb/a/base/barcodeDetail/. The manipulation of the argument barcodeNo/barcode/itemNo leads to SQL injection. The...

XAgent 路径遍历漏洞

XAgent is an open source experimental Large Language Model LLM-driven autonomous agent from OpenBMB. A path traversal vulnerability exists in XAgent 1.0.0 and earlier versions, which stems from a path traversal in the file /conv/community...

Malicious code in worldhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c09616d1a3cf63c69efe5b81863fee024898fd16025a96efa3e70504012bb6bd The OpenSSF Package Analysis project identified 'worldhello' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package execut...

Malicious code in o11y-ds-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fca3e674d984eeb8be380f95b3033584360c55efdc438f8f43c521b0d7239f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in client-vue3-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 949b1148db60c58f37c8fec03067aa1974329c0f5719de4425b8840f213b5f2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in getsourcefile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44a69b03b0d5efbf48210cf0f786f2653910ba129aa89e00c5cd6a995f6ee9df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 WordPress Likes and Dislikes 1.0.0 SQL Injection

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the post parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-24616 · WordPress · Inprosysmedia-Likes-Dislikes-Post

Name of the Vulnerable Software and Affected Versions: inprosysmedia-likes-dislikes-post WordPress plugin version 1.0.0 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to...

PT-2025-24531 · Unknown · Unfoldwp Blogty

Name of the Vulnerable Software and Affected Versions: Unfoldwp Blogty versions 1.0.0 through 1.0.11 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

CVE-2025-49127 Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration

Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue...