CVE-2025-3541 H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getSpecs FCGI_WizardProtoProcess command injection

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this issue is the function FCGIWizardProtoProcess of the file /api/wizard/getSpecs of the component HTTP POST Request Handler. The...

@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +57 more potentially affected by CVE-2025-32395 via vite (>=6.0.0, <=6.0.11)

vite NPM version =6.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =5.0.0-alpha.38 and more Sour...

WordPress SpaBiz Theme <= 1.0.18 is vulnerable to Cross Site Scripting (XSS)

Software SpaBiz Type Theme Vulnerable versions = 1.0.18 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-26740 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID df996b7e733c Credits stealthcopter Required privilege Contributor...

WordPress WP AutoKeyword Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin WP AutoKeyword versions = 1.0...

WordPress More Mime Type Filters plugin <= 0.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin More Mime Type Filters versions = 0.3...

WordPress ALD Login Page plugin <= 1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin ALD Login Page versions = 1.1...

WordPress Simple Post Meta Manager Plugin <= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerability

CSRF to Reflected Cross-Site Scripting vulnerability discovered by thiennv in WordPress Plugin Simple Post Meta Manager versions = 1.0.9...

WordPress WP Subscription Forms plugin <= 1.2.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Subscription Forms versions = 1.2.4...

WordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Duplicate Title Checker versions = 1.2...

WordPress Database Toolset Plugin <= 1.8.4 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by LVT-tholv2k in WordPress Plugin Database Toolset versions = 1.8.4...

@0xyy/elpis (>=1.0.0, <=1.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1453 more potentially affected by CVE-2025-32379 via koa (>=2.0.0, <=2.16.0)

koa NPM version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.1.3 - @ahua0920/elpis 1.0.0 and more Source cves: CVE-2025-32379 Source advisory: OSV:GHSA-X2RG-Q646-7M2V...

Microsoft Office 2016 Security Feature Bypass Vulnerability (KB5002573)

This host is missing an important security update according to Microsoft KB5002573 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

WordPress Bulk Product Sync plugin <= 8.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by theviper17 in WordPress Plugin Bulk Product Sync versions = 8.6...

PT-2025-15344

Name of the Vulnerable Software and Affected Versions: secfr trustlet versions prior to SMR Apr-2025 Release 1 Description: The issue allows local privileged attackers to cause memory corruption due to an out-of-bounds write in the secfr trustlet. Recommendations: For versions prior to SMR Apr-20...

PT-2025-15407 · Siemens · Siemens License Server

Name of the Vulnerable Software and Affected Versions: Siemens License Server SLS versions prior to V4.3 Description: The issue is related to improper restriction of user permissions, which could allow a low-privileged attacker to escalate their privileges. Recommendations: For versions prior to...

WordPress coreActivity: Activity Logging for WordPress plugin <= 2.7 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Yassine NEGGAOUI in WordPress Plugin coreActivity: Activity Logging plugin for WordPress versions = 2.7...

CVE-2025-22842 arkcompiler_ets_runtime has an out-of-bounds read vulnerability

in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read...

WordPress Streamit Theme <= 4.0.2 is vulnerable to Privilege Escalation

Software Streamit Type Theme Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-2526 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6913aeb6838d Credits István Márton...

PT-2025-15113 · Unknown · Codeprojects Online Restaurant Management System

Name of the Vulnerable Software and Affected Versions: codeprojects Online Restaurant Management System version 1.0 Description: A critical issue affects the processing of the file /admin/reservation update.php. The manipulation of the ID argument leads to SQL injection. The attack may be initiat...

WordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Freetobook Responsive Widget versions = 1.1...