WordPress Ajax Search Lite plugin <= 4.12.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ajax Search Lite versions = 4.12.2...

WordPress Podlove Podcast Publisher plugin < 4.2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Podlove Podcast Publisher versions 4.2.1...

WordPress Prisna GWT plugin < 1.4.14 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Prisna GWT – Google Website Translator versions 1.4.14...

PT-2025-21833 · Unknown · Phpgurukul Directory Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Directory Management System version 2.0 Description: A problematic issue has been found in the PHPGurukul Directory Management System, affecting some unknown functionality of the file /searchdata.php. The manipulation of the...

WordPress Seven Stars theme <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Seven Stars versions = 1.4.4...

WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin WP Ultimate Tours Builder versions = 1.055...

WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Anhchangmutrang in WordPress Plugin QuickCal - Appointment Booking Calendar for WordPress versions = 1.0.15...

WordPress Interview plugin <= 1.01 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by 0x1ceKing in WordPress Plugin Interview versions = 1.01...

WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Uncanny Toolkit for LearnDash versions = 3.7.0.2...

WordPress Plant - Gardening & Houseplants WordPress Theme Theme <= 1.0.0 is vulnerable to Sensitive Data Exposure

Software Plant - Gardening & Houseplants WordPress Theme Type Theme Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2025-31051 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ca2fd8b84100 Credit...

WordPress Spare Theme <= 1.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Spare Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2025-31639 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8be491392588 Credits Tran Nguyen Bao Khanh VCI - VN...

WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change Vulnerability

Settings Change Vulnerability discovered by ch4r0n in WordPress Plugin Experto CTA Widget Call To Action, Sticky CTA, Floating Button Plugin versions = 1.1.1...

Adobe Dreamweaver Arbitrary Code Vulnerability (APSB25-35) - Mac OS X

Adobe Dreamweaver is prone to an arbitrary code vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:dreamweaver"...

webERP 安全漏洞

webERP is an open source inventory and financial management system ERP system by Tim Schofield, an individual developer. The system supports inventory management, permission role management, order management and financial management. A security vulnerability exists in webERP version v4.15.2, whic...

CVE-2025-29690

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java...

CVE-2025-43554

Substance3D - Modeler versions 1.21.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-47278 Flask uses fallback key instead of current signing key

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2025-1516)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress BNS Twitter Follow Button plugin <= 0.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin BNS Twitter Follow Button versions = 0.3.8...

WordPress Depicter Plugin 3.6.1 - SQL Injection

Exploit Title: WordPress Depicter Plugin 3.6.1 - SQL Injection Google Dork: inurl:/wp-content/plugins/depicter/ Date: 2025-05-06 Exploit Author: Andrew Long datagoboom Vendor Homepage: https://wordpress.org/plugins/depicter/ Software Link: https://downloads.wordpress.org/plugin/depicter.3.6.1.zip...