WordPress plugin Soccer Live Scores 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2025-46816 goshs route not protected, allows command execution

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitra...

CVE-2025-46735 Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version 1.0.5. The windnsrecord resource did not sanitize the input variables. This could lead to authenticated command...

CVE-2025-46735 Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version 1.0.5. The windnsrecord resource did not sanitize the input variables. This could lead to authenticated command...

CVE-2025-46735

CVE-2025-46735 concerns the Terraform WinDNS Provider, where the windns_record resource did not sanitize input variables, enabling authenticated command injection in the underlying PowerShell prompt. Affected software is the Terraform WinDNS Provider (prior to version 1.0.5). The issue’s impact i...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass through the dispatchReadPump function. An attacker can execute arbitrary commands by sending specially crafted websocket requests. PoC echo -e '"type": "command", "content": "id"' |./websocat...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the windnsrecord resource. An attacker can execute arbitrary commands on the underlying system by injecting malicious inputs into the PowerShell command prompt used by the application. Remediation Upgrade...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the windnsrecord resource. An attacker can execute arbitrary commands on the underlying system by injecting malicious inputs into the PowerShell command prompt used by the application. Remediation Upgrade...

Terraform WinDNS Provider 命令注入漏洞

Terraform WinDNS Provider is a Norsk rikskringkasting open source tool for managing DNS records in Windows DNS servers using Terraform. A command injection vulnerability exists in Terraform WinDNS Provider versions prior to 1.0.5, which stems from failure to clean up input variables and could lea...

IBM Concert 代码问题漏洞

IBM Concert is a new tool from International Business Machines IBM, Inc. that uses generative AI to help manage complex cloud-native applications. A code issue vulnerability exists in IBM Concert 1.0.5 and prior versions that stems from the presence of server-side request forgery, which could...

CVE-2025-46517

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdiscover Blog Manager WP blog-manager-wp allows Stored XSS.This issue affects Blog Manager WP: from n/a through = 1.0.5...

CVE-2025-32511

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce make-email-customizer-for-woocommerce allows Reflected XSS.This issue affects Make Email Customizer for WooCommerce: from n/a through = 1.0....

CVE-2025-39433

Cross-Site Request Forgery CSRF vulnerability in bekero Bknewsticker bknewsticker allows Stored XSS.This issue affects Bknewsticker: from n/a through = 1.0.5...

CVE-2025-46516

Cross-Site Request Forgery CSRF vulnerability in silencecm Twitter Card Generator twitter-card-generator allows Stored XSS.This issue affects Twitter Card Generator: from n/a through = 1.0.5...

CVE-2025-46517

CVE-2025-46517 : Stored XSS in WordPress Blog Manager WP plugin (Blog Manager WP) due to improper input neutralization during web page generation. Affected versions are Blog Manager WP from n/a through 1.0.5. The provided documents describe the vulnerability and affected range but do not specify ...

CVE-2025-46517 WordPress Blog Manager WP <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdiscover Blog Manager WP allows Stored XSS. This issue affects Blog Manager WP: from n/a through 1.0.5...

CVE-2025-46516

CVE-2025-46516 covers a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “Twitter Card Generator,” allowing Stored XSS. The issue affects versions from release up to 1.0.5. Public references (NVD/PATCHSTACK) corroborate CSRF leading to Stored XSS but do not provide a patche...

WordPress plugin Zoho Creator Forms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Blog Manager WP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Make Email Customizer for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...