WordPress Classiera Theme <= 4.0.34 is vulnerable to SQL Injection

Software Classiera Type Theme Vulnerable versions = 4.0.34 Fixed in 4.0.35 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2025-52722 Patch priority High CVSS severity High 9.3 Developer Joinwebs PSID bef854c7c688 Credits Lê Quốc Bảo Required privilege Unauthenticated Published 1...

GHSA-8GQP-HR9G-PG62 Conductor vulnerable to OS command injection through unrestricted access to Java classes

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes...

WordPress Game Users Share Buttons plugin <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via themeNameId Parameter vulnerability discovered by theviper17y in WordPress Plugin Game Users Share Buttons versions = 1.3.0...

CVE-2025-53097 Roo Code extension vulnerable to Potential Information Leakage via JSON Schema

Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's searchfiles tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was able to inject a prompt into the agent coul...

CVE-2025-45737

An issue in NetEase Hangzhou Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to the NeacSafe64.sys component...

WordPress Post Carousel Slider for Elementor plugin <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function vulnerability

Authenticated Subscriber+ Missing Authorization via processwbelpspromoform Function vulnerability discovered by Peter Thaleikis in WordPress Plugin Post Carousel Slider for Elementor versions = 1.6.0...

PT-2025-26826 · Unknown · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /panel/add-staff.php. The manipulation of the Name argument leads to SQL injection. It is possibl...

WordPress Conference Scheduler plugin <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via className Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Conference Scheduler versions = 2.5.1...

NETGEAR EX6100 安全漏洞

The NETGEAR EX6100 is a WiFi range extender from NETGEAR. A security vulnerability exists in the NETGEAR EX6100 version 1.0.2.281.1.138 that stems from a stack buffer overflow in the sub415EF8 function...

HTACG HTML Tidy 安全漏洞

HTACG HTML Tidy is an open source HTML tool from HTML Tidy Advocacy Community Group. A security vulnerability exists in HTACG HTML Tidy version 5.8.0 due to a null pointer dereference in the function InsertNodeAsParent in the file src/parser.c. The vulnerability is caused by the presence of a nul...

PT-2025-26510 · Unknown · Phpgurukul Art Gallery Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Art Gallery Management System version 1.1 Description: A critical issue was found in the PHPGurukul Art Gallery Management System. The problem is related to an unknown function in the file /admin/edit-art-medium-detail.php, where t...

Ingress-NGINX 4.11.0 - Remote Code Execution (RCE)

Exploit Title: Ingress-NGINX 4.11.0 - Remote Code Execution RCE Google Dork: N/A Date: 2025-06-19 Exploit Author: Likhith Appalaneni Vendor Homepage: https://kubernetes.github.io/ingress-nginx/ Software Link: https://github.com/kubernetes/ingress-nginx Version: ingress-nginx v4.11.0 on Kubernetes...

WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by s1lentmt in WordPress Plugin WP User Profile Avatar versions = 1.0.6...

WordPress WP Customer Area plugin <= 8.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Tran Tuan Dung domiee13 in WordPress Plugin WP Customer Area versions = 8.3.4...

WordPress CSV Importer Improved plugin <= 0.6.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin CSV Importer Improved versions = 0.6.1...

WordPress WP Voting Contest plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by greenhats in WordPress Plugin WP Voting Contest versions = 5.8...

WordPress Simple Sticky Footer plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Simple Sticky Footer versions = 1.3.5...

WordPress RDFa Breadcrumb plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin RDFa Breadcrumb versions = 2.3...

WordPress Lewe ChordPress plugin <= 4.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability

Cross Site Request Forgery CSRF to Stored XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Lewe ChordPress versions = 4.0.1...

WordPress ElementsKit Lite plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Image Comparison Widget vulnerability discovered by Asaf Mozes in WordPress Plugin ElementsKit Elementor addons Lite versions = 3.5.2...