WordPress Forminator Forms plugin <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter vulnerability

Authenticated Administrator+ SQL Injection via orderby Parameter vulnerability discovered by Chive in WordPress Plugin Forminator versions = 1.45.0...

qBittorrent 安全漏洞

qBittorrent is a cross-platform, lightweight BitTorrent client open-sourced by qBittorrent. A security vulnerability exists in qBittorrent versions prior to 5.1.2, which stems from unrestricted access to local files and could lead to information disclosure...

PT-2025-30224 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748 B20211015 Description: A critical issue has been identified in the MQTT Service component of the affected software. The recvSlaveUpgstatus function is susceptible to a buffer overflow when the s argument is...

WordPress Transposh WordPress Translation plugin <= 1.0.8.1 - Missing Authorization Checks vulnerability

Missing Authorization Checks vulnerability discovered by Julien Ahrens in WordPress Plugin Transposh WordPress Translation versions = 1.0.8.1...

TOTOLINK N350RT 安全漏洞

The TOTOLINK N350RT is a small home router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in the TOTOLINK N350RT version V9.3.5u.6139B20201216, which stems from the ePort parameter failing to correctly validate the length and size of the input data, and can be...

WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin FG Drupal to WordPress versions = 3.90.0...

WordPress JetWooBuilder plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter in WordPress Plugin JetWooBuilder versions = 2.1.20...

CVE-2025-53833

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

PT-2025-29382 · Roundup · Roundup

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.5.0 Description: Roundup is susceptible to a cross-site scripting issue. This occurs through the interaction between URLs and issue tracker templates devel and responsive. Recommendations: Update Roundup to version...

WordPress Order Delivery Date Pro for WooCommerce plugin < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure vulnerability

Unauthenticated Arbitrary Post Title Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Order Delivery Date for WP e-Commerce versions 12.6.0...

Microsoft PC Manager Elevation of Privilege Vulnerability (Jul 2025) - Windows

Microsoft PC Manager is prone to an elevation of privilege vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Responsive Coming Soon Landing Page / Holding Page for WordPress plugin <= 3.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Responsive Coming Soon Landing Page / Holding Page for WordPress versions = 3.0...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-webflux-5.3.27.jar

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of spring-webflux-5.3.27.jar Vulnerability Details CVEID:CVE-2024-38819 DESCRIPTION: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks...

WordPress WP Firebase Push Notification plugin <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification vulnerability

Cross-Site Request Forgery to Broadcast Notification vulnerability discovered by Nabil Irawan in WordPress Plugin WP Firebase Push Notification versions = 1.2.0...

PT-2025-28227 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 version 5.5.16 Description: The issue allows a remote attacker to obtain sensitive information. This is achieved via the "bbs/member confirm.php" endpoint. Recommendations: For gnuboard5 version 5.5.16, consider restricting access t...

CVE-2025-7061

A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/operador/. The manipulation leads to csv injection. The attack can be initiated remotely. The exploit has been disclosed to the public and...

PT-2025-27927 · Unknown · The Beautiful Cookie Consent Banner

Name of the Vulnerable Software and Affected Versions: Nikel Beautiful Cookie Consent Banner versions through 4.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2025-49867 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9303a55298f9 Credits Frank Required privilege...

CVE-2024-49364 tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment

tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...

PT-2025-27566 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.7.7 Description: The issue concerns the exposure of a PHP phpinfo debug page to unauthenticated users, potentially containing sensitive data useful for an attacker. Recommendations: For versions...