CVE-2025-47525 WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through = 5.3.0...

WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Bold Page Builder versions = 5.3.0...

WordPress plugin Bold Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-30767

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.3.0...

CVE-2025-30767 WordPress PDF for WPForms plugin <= 5.3.0 - Arbitrary Shortcode Execution vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.3.0...

PT-2024-34631 · Espressif · Espressif Esp-Idf

Name of the Vulnerable Software and Affected Versions: Espressif Esp idf version 5.3.0 Description: The issue allows attackers to cause a Denial of Service DoS via a crafted data channel packet. This can be exploited by sending a specially crafted packet to the affected system. Recommendations: F...

PT-2024-30523 · Joomsport · Joomsport

Name of the Vulnerable Software and Affected Versions: JoomSport versions 5.3.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For JoomSport versions 5.3.0 and...

WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin JoomSport versions = 5.3.0...

CVE-2024-23321

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...

WordPress Custom Query Blocks Plugin <= 5.2.0 is vulnerable to Broken Access Control

Software Custom Query Blocks Type Plugin Vulnerable versions = 5.2.0 Fixed in 5.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-38794 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c14273e201ef Credits Joshua Chan Required...

WordPress plugin MyRewards 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-24774 · Long Watch Studio · Myrewards

Name of the Vulnerable Software and Affected Versions: Long Watch Studio MyRewards versions n/a through 5.3.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to...

Command injection

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview rmagick is an an interface between Ruby and ImageMagick. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' via the DrawOptionsinitialize function in rmdraw.c. An attacker can cause a denial of service by exhausting memory resource...

PT-2023-13460 · Nokelock · Nokelock Smart Padlock O1 +1

Name of the Vulnerable Software and Affected Versions: Nokelock Smart padlock O1 version 5.3.0 Description: The issue allows an attacker to send a request and add any device, as well as set the device password in the Nokelock app, due to insecure permissions. Recommendations: For version 5.3.0,...

CVE-2023-35169

The CVE-2023-35169 issue affects PHP-IMAP (Webklex/php-imap) up to version 5.2.x when attachments are saved via Attachment::save(path, filename) without a sanitized or provided filename. This enables a directory traversal in unsanitized attachment filenames, allowing unauthenticated attackers to ...

Atlassian Jira Service Management 5.5.0 < 5.3.3 Critical Authentication Vulnerability

According to its self-reported version number, the Atlassian Jira Service Management application running on the remote host is version 5.3.0 prior to version 5.3.3, 5.4.0 prior to 5.4.2 or 5.5.0 prior to 5.3.3. It is, therefore, affected by a critical authentication vulnerability which allows a...

PT-2023-20150 · Dell · Dell Trusted Device Agent

Name of the Vulnerable Software and Affected Versions: Dell Trusted Device Agent versions prior to 5.3.0 Description: The issue is related to improper installation permissions, allowing an unauthenticated local attacker to potentially exploit it and gain escalated privileges. Recommendations: For...

Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...