CVE-2025-8696 DoS attack against the Stork UI from an unauthenticated user

If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0...

Malicious code in aledade-org (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0682631cc0174823a4b9e6c15e0d9f83771e5a51dfaec02c64a878a3b0d6c56a The OpenSSF Package Analysis project identified 'aledade-org' @ 1.0.0...

MAL-2025-46995 Malicious code in aledade-org (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0682631cc0174823a4b9e6c15e0d9f83771e5a51dfaec02c64a878a3b0d6c56a The OpenSSF Package Analysis project identified 'aledade-org' @ 1.0.0...

CVE-2025-59008

CVE-2025-59008 relates to the WordPress plugin “ZIP Code Based Content Protection.” It describes an SQL injection caused by improper neutralization of input in versions up to 1.0.0. The vulnerability is network‑level with high privileges required and no user interaction, and it has a high impact ...

CVE-2025-59008 WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PressTigers ZIP Code Based Content Protection zip-code-based-content-protection allows SQL Injection.This issue affects ZIP Code Based Content Protection: from n/a through = 1.0.0...

PT-2025-36815

Name of the Vulnerable Software and Affected Versions: PressTigers ZIP Code Based Content Protection versions through 1.0.0 Description: The software contains a SQL injection issue due to improper neutralization of special elements used in an SQL command. This allows for SQL injection...

CVE-2025-10097

CVE-2025-10097 affects SimStudioAI sim up to 1.0.0. The vulnerability is a code injection in the file apps/sim/app/api/function/execute/route.ts caused by manipulation of the code argument, with the attack described as remotely executable. The connected sources consistently reference arbitrary co...

CVE-2025-10097 SimStudioAI sim route.ts code injection

A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely...

WordPress Lab Theme <= 1.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Lab versions = 1.0.0...

WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by RoyTdd in WordPress Plugin ZIP Code Based Content Protection versions = 1.0.0...

Apache Jackrabbit Core和Apache Jackrabbit JCR Commons 安全漏洞

Apache Jackrabbit Core and Apache Jackrabbit JCR Commons are both products of the Apache Foundation.Apache Jackrabbit Core is a content repository core.Apache Jackrabbit JCR Commons is a general-purpose tool library. A security vulnerability exists in Apache Jackrabbit Core versions 1.0.0 through...

Weitong Mall 授权问题漏洞

Weitong Mall 微同商城 is a shopping mall system by fuyanglipengjun, an individual developer. An authorization issue vulnerability exists in Weitong Mall version 1.0.0, which stems from an improper authorization issue in the /adposition/queryAll file...

PT-2025-36482

Name of the Vulnerable Software and Affected Versions: SimStudioAI sim versions up to 1.0.0 Description: A vulnerability exists in SimStudioAI sim up to version 1.0.0. The issue involves code injection due to the manipulation of the code argument within an unknown function of the file...

Sim Studio 代码问题漏洞

Sim Studio is an AI agent workflow builder for Sim Studio open source. A code issue vulnerability exists in Sim Studio 1.0.0 and prior versions, which stems from an incorrect manipulation of the parameter filePath that could lead to server-side request forgery...

CVE-2025-58887

CVE-2025-58887 affects the WordPress Course Booking Platform plugin (versions up to 1.0.0). It is a Stored XSS vulnerability arising from improper input neutralization during web page generation, with a CVSSv3.1 base score of 6.5 (Medium). The vulnerability impacts Course Booking Platform; no pat...

CVE-2025-58878

CVE-2025-58878 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Woocommerce Gifts Product, affecting versions up to 1.0.0. The initial and connected documents confirm the vulnerability type and affected product/versions, but do not specify a patched version or r...

WordPress plugin Woocommerce Gifts Product 跨站请求伪造漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in WordPress plugin...

WordPress plugin Course Booking Platform 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-36216

Name of the Vulnerable Software and Affected Versions: Woocommerce Gifts Product versions through 1.0.0 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations:...

Security Bulletin: Astronomer with IBM is vulnerable to weak encryption due to the jose package (CVE-2025-45767)

Summary Jose is used by Astronomer with IBM as part of the JSON encryption functionality. Vulnerability Details CVEID:CVE-2025-45767 DESCRIPTION: jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security...