WordPress Basic Interactive World Map plugin <= 2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Basic Interactive World Map versions = 2.7...

Rancher 安全漏洞

Rancher is an open source container management platform open-sourced by Rancher in the United States, built for organizations that deploy containers in production environments. A security vulnerability exists in Rancher versions 2.7.0 through 2.7.16 prior, 2.8.0 through 2.8.9 prior, and 2.9.0...

CVE-2025-32661

Cross-Site Request Forgery CSRF vulnerability in WP Map Plugins Interactive US Map interactive-us-map allows Stored XSS.This issue affects Interactive US Map: from n/a through = 2.7...

WordPress plugin Interactive US Map 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-3436

CVE-2025-3436 affects the WordPress plugin “coreActivity: Activity Logging for WordPress.” The vulnerability is an SQL injection in the query built from user-supplied parameters order and orderby, impacting all versions up to and including 2.7. Exploitation requires authentication at Subscriber l...

CVE-2025-3436 coreActivity: Activity Logging for WordPress <= 2.7 - Authenticated (Subscriber+) SQL Injection

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

PT-2025-14904 · Unknown · Elunez Eladmin

Name of the Vulnerable Software and Affected Versions: elunez eladmin version 2.7 Description: A problematic issue has been found in the Maintenance Management Module, affecting some unknown functionality of the file "/api/database/testConnect". This issue leads to deserialization and can be...

DLA-4082-1 ruby2.7 - security update

Bulletin has no description...

PT-2025-8917 · WordPress · Templines Elementor Helper Core +1

Name of the Vulnerable Software and Affected Versions: Templines Elementor Helper Core plugin for WordPress versions up to, and including, 2.7 Description: The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation due to allowing arbitrary user meta updates...

CVE-2025-25125

Cross-Site Request Forgery CSRF vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through = 3.1...

CVE-2025-25125 WordPress Fyrebox Quizzes plugin <= 2.7 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in CyrilG Fyrebox Quizzes allows Stored XSS. This issue affects Fyrebox Quizzes: from n/a through 2.7...

CVE-2025-25125

CVE-2025-25125 concerns a CSRF to stored XSS vulnerability in WordPress plugin Fyrebox Quizzes (CyrilG) affecting versions from n/a up to 2.7. The CVE is tracked in multiple feeds; the vulnerability is confirmed in WordPress/Fyrebox Quizzes context and is rated 7.1 ( HIGH ) by CVSS 3.1 with netwo...

CVE-2025-25125 WordPress Fyrebox Quizzes plugin <= 3.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through = 3.1...

WordPress plugin BeBetter Social Icons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-10546

The CVE-2024-10546 entry concerns open-scratch Teaching 在线教学平台 (versions up to 2.7). The vulnerability exists in the URL Handler’s API endpoint /api/sys/ng-alain/getDictItemsByTable/ and is due to an SQL injection in that API. It is exploitable remotely and an exploit has been disclosed publicly....

PT-2024-38367 · Elunez · Elunez Eladmin

Name of the Vulnerable Software and Affected Versions: elunez eladmin versions up to 2.7 Description: A critical issue affects the Database Management/Deployment Management component, specifically the /api/deploy/upload and /api/database/upload API endpoints. The manipulation of the file argument...

CVE-2024-3799 Shell command injection in Phoniebox

Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reach...

Rancher Labs Rancher Security Vulnerabilities

Rancher Labs Rancher is a suite of open source, enterprise-grade container management platforms from Rancher Labs, Inc. in the United States. A security vulnerability in Rancher Labs Rancher version 2.x prior to 2.6.13 and version 2.7.x prior to 2.7.4, which stems from a misapplied authorization...

CVE-2023-5099

The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of the 'csvsearch' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute...

CVE-2023-41962

Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page...