5860 matches found
PT-2026-1105
Name of the Vulnerable Software and Affected Versions Vatilon version 1.12.37-20240124 Description The software transmits user credentials in plaintext. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
PT-2026-1067
Name of the Vulnerable Software and Affected Versions REDCap version 14.3.13 Description REDCap version 14.3.13 is affected by an issue that allows an attacker to enumerate usernames due to an observable discrepancy between login attempts. Recommendations At the moment, there is no information...
PT-2026-26529
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 146.0.7680.153 Description A use-after-free issue exists in the Extensions component of Google Chrome. This flaw could allow an attacker to convince a user to install a malicious extension, potentially leading t...
CVE-2025-59136 WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through 3.1.3...
CVE-2025-68983
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through = 4.2.11...
CVE-2025-69091
CVE-2025-69091 relates to Demo Importer Plus (WordPress plugin) and is tied to a Missing Authorization vulnerability due to incorrectly configured access control. The issue affects Demo Importer Plus versions from prior to or at 2.0.8 and is documented in Wordfence as Missing Authorization. The W...
CVE-2025-68991 WordPress BWL Pro Voting Manager plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through = 1.4.9...
CVE-2025-15222
CVE-2025-15222 affects Dromara Sa-Token up to 1.44.0. The vulnerability is a deserialization flaw in ObjectInputStream.readObject within SaSerializerTemplateForJdkUseBase64.java, enabling remote manipulation with high complexity and publicly disclosed exploit. Multiple connected sources (Red Hat,...
SUSE CVE-2025-15095
A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used...
PT-2025-53759
Name of the Vulnerable Software and Affected Versions BinUtils version 2.26 Description An issue exists in the d discriminator function within the cp-demangle.c file of BinUtils. This can lead to a denial of service when processing specially crafted PE files. Recommendations Update BinUtils to a...
PT-2025-53789
Name of the Vulnerable Software and Affected Versions givanz VvvebJs version 1.7.2 Description givanz VvvebJs version 1.7.2 is subject to a File Upload issue through the save.php file. Recommendations At the moment, there is no information about a newer version that contains a fix for this...
WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability
Software : Fana Type : Theme Vulnerable versions : = 1.1.35 Fixed in : 1.1.36 OWASP Top 10 : A3: Injection Classification : Local File Inclusion CVE ID : CVE-2025-68540 Patchstack priority : Low CVSS severity : 7.5 Required privilege : Contributor Developer : Claim ownership PSID : 1370613da8d7...
PT-2025-53655
Name of the Vulnerable Software and Affected Versions saiftheboss7 onlinemcqexam versions prior to 0e56806132971e49721db3ef01868098c7b42ada Description A SQL injection issue exists in saiftheboss7 onlinemcqexam. The issue is located in the file /admin/quesadd.php and involves manipulation of the...
CVE-2025-57403
Cola Dnslog v1.3.2 is affected by a Directory Traversal vulnerability in the DNS TXT query handling. The root cause is the application concatenating the requested URL (or a portion) with a base path via os.path.join, allowing directory traversal or absolute path injection and potentially exposing...
CVE-2025-57403
Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL or a portion of it directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to th...
CVE-2025-68603 WordPress Editorial Calendar plugin <= 3.8.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through = 3.8.8...
CVE-2025-68574 WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through = 1.0.4.3...
PT-2025-53262
Name of the Vulnerable Software and Affected Versions WPBakery Visual Composer WHMCS Elements versions through 1.0.4.3 Description The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-site Scripting issue. This allows for the...
CVE-2025-68114
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStreamconcat lets a malicious csoptmem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit...