CVE-2025-32514

CVE-2025-32514 is a Reflected XSS in the WordPress plugin “WooCommerce Estimate and Quote” (WC Estimate and Quote) affecting versions up to 1.0.2.5. The root cause is improper neutralization of user input during web page generation. The vulnerability could allow an attacker to inject and execute ...

CVE-2025-32646 WordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Question Answer question-answer allows Reflected XSS.This issue affects Question Answer: from n/a through = 1.2.70...

CVE-2025-39455 WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through = 2.9.5...

CVE-2025-39538

The CVE-2025-39538 entry concerns the WordPress WP-Advanced-Search plugin (affected versions up to 3.3.9.3). It describes an Unrestricted Upload of File with Dangerous Type vulnerability that allows an attacker to upload a PHP web shell to the server via the plugin’s import/export function, poten...

CVE-2025-21578

Vulnerability in Oracle Secure Backup component: General. Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes t...

CVE-2025-21585

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MyS...

CVE-2025-21581

Removed by vendor...

CVE-2024-13177 Symlink Following in Netskope Client Postinstall Script

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system...

CVE-2025-23388

A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3...

CVE-2025-32568

Deserialization of Untrusted Data vulnerability in empik EmpikPlace for Woocommerce empik-for-woocommerce allows Object Injection.This issue affects EmpikPlace for Woocommerce: from n/a through = 1.4.3...

CVE-2025-23388

CVE-2025-23388 affects SUSE Rancher with a stack-based buffer overflow that can cause denial of service. Affected versions are 2.8.0–2.8.13, 2.9.0–2.9.7, and 2.10.0–2.10.3. The CVE is described as an unauthenticated stack overflow in the /v3-public/authproviders API. Remediation is to upgrade to ...

CVE-2025-32607 WordPress WpBookingly plugin <= 1.2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly allows Object Injection. This issue affects WpBookingly: from n/a through 1.2.0...

CVE-2025-32577 WordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through = 1.0.23...

CVE-2025-32698 LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1...

CVE-2025-2568

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayublocksgettoggleswitchvaluescallback' and 'vayublockssavetoggleswitchcallback' function in versions 1.0.4 t...

CVE-2025-32687

CVE-2025-32687 is an SQL Injection vulnerability in the WordPress plugin Review Stars Count For WooCommerce (Magnigenie). The Initial Description states impact on Review Stars Count For WooCommerce, affecting versions up to 2.0 (vendor/app unspecified). The connected Wordfence entry confirms the ...

GitLab 7.7 < 17.8.7 / 17.9 < 17.9.6 / 17.10 < 17.10.4 (CVE-2025-0362)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick...

CVE-2025-25254

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests...

CVE-2025-32149

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in winkm89 teachPress teachpress allows SQL Injection.This issue affects teachPress: from n/a through = 9.0.11...

CVE-2025-31554

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal.This issue affects Docxpresso: from n/a through = 2.6...