5811 matches found
WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability
XML External Entity XXE vulnerability discovered by mcdruid in WordPress Plugin Category Icon versions = 1.0.3...
WordPress Ultimate Gift Cards for WooCommerce plugin <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function vulnerability
Authenticated Administrator+ SQL Injection via wpswgmsavepost Function vulnerability discovered by Abdulaziz Alzamil in WordPress Plugin Ultimate Gift Cards For WooCommerce versions = 3.1.4...
WordPress Royal Elementor Addons and Templates plugin <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin Royal Elementor Addons versions = 1.7.1020...
WordPress Element Pack Elementor Addons plugin <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by Robert DeVore in WordPress Plugin Element Pack Elementor Addons versions = 5.11.2...
WordPress Number of Products per Page – Pagination Manager for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin Number of Products per Page Pagination Manager for WooCommerce versions = 2.4.0...
WordPress WordPress Gearside Developer Dashboard plugin <= 1.0.72 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Tommaso Gregori p1s1o in WordPress Plugin Gearside Developer Dashboard versions = 1.0.72...
Tinxy WiFi Lock Controller 安全漏洞
Tinxy WiFi Lock Controller is a smart door lock from Tinxy. A security vulnerability exists in Tinxy WiFi Lock Controller v1. The vulnerability stems from storing sensitive user information in clear text, which may lead to information leakage...
CVE-2025-32440
NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to...
WordPress Smash Balloon Instagram Feed plugin <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via data-plugin Attribute vulnerability discovered by Asaf Mozes in WordPress Plugin Instagram Feed versions = 6.9.0...
CVE-2025-47748
Netwrix Directory Manager vulnerable versions: 11.0.0.0 and earlier, and 11.1.25134.03 and later, contain a hardcoded password. This is a configuration/credential risk that could lead to credential exposure via a hardcoded secret. Remediation exists in linked advisories: update to a version where...
Mozilla Firefox ESR Security Update (mfsa_2025-43) - Mac OS X
Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...
WordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Poystick Patchstack Alliance in WordPress Plugin Volunteer Sign Up Sheets versions 5.5.5...
Microsoft Raw Image Extension RCE Vulnerability (May 2025) - Windows
Microsoft Raw Image Extension is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Microsoft VP9 Video Extensions Information Disclosure Vulnerability (May 2025) - Windows
Microsoft VP9 Video Extensions is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Apache Commons Configuration 1.x DoS Vulnerability
The Apache Commons Configuration library is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...
Microsoft Paint 3D Multiple RCE Vulnerabilities (May 2025) - Windows
Microsoft Paint 3D is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
WordPress WP SMTP plugin <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email vulnerability
Unauthenticated Stored Cross-Site Scripting via Email vulnerability discovered by zer0gh0st in WordPress Plugin WP SMTP versions = 2.1.5...
CVE-2025-36527
CVE-2025-36527 affects Zohocorp ManageEngine ADAudit Plus versions below 8511. The issue is a SQL injection during report export , with CVSS 3.1 base score 8.3 (HIGH). Connected sources also reference a fix recommendation: upgrade to version 8511 or later to resolve the vulnerability. A temporary...
CVE-2024-25832
F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension...