WordPress Bulk Product Sync plugin <= 8.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by theviper17 in WordPress Plugin Bulk Product Sync versions = 8.6...

PT-2025-15407 · Siemens · Siemens License Server

Name of the Vulnerable Software and Affected Versions: Siemens License Server SLS versions prior to V4.3 Description: The issue is related to improper restriction of user permissions, which could allow a low-privileged attacker to escalate their privileges. Recommendations: For versions prior to...

PT-2025-15344

Name of the Vulnerable Software and Affected Versions: secfr trustlet versions prior to SMR Apr-2025 Release 1 Description: The issue allows local privileged attackers to cause memory corruption due to an out-of-bounds write in the secfr trustlet. Recommendations: For versions prior to SMR Apr-20...

WordPress coreActivity: Activity Logging for WordPress plugin <= 2.7 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Yassine NEGGAOUI in WordPress Plugin coreActivity: Activity Logging plugin for WordPress versions = 2.7...

CVE-2025-22842 arkcompiler_ets_runtime has an out-of-bounds read vulnerability

in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read...

WordPress Streamit Theme <= 4.0.2 is vulnerable to Privilege Escalation

Software Streamit Type Theme Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-2526 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6913aeb6838d Credits István Márton...

PT-2025-15113 · Unknown · Codeprojects Online Restaurant Management System

Name of the Vulnerable Software and Affected Versions: codeprojects Online Restaurant Management System version 1.0 Description: A critical issue affects the processing of the file /admin/reservation update.php. The manipulation of the ID argument leads to SQL injection. The attack may be initiat...

WordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Freetobook Responsive Widget versions = 1.1...

WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.9.4...

WordPress eaSYNC plugin <= 1.3.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin eaSYNC versions = 1.3.19...

WordPress News Element Elementor Blog Magazine plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin News Element Elementor Blog Magazine versions = 1.0.8...

WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k in WordPress Plugin Motors versions = 1.4.71...

WordPress Chamber Dashboard Business Directory plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Chamber Dashboard Business Directory versions = 3.3.11...

WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Real Estate Manager versions = 7.3...

WordPress Sidebar Manager Light plugin <= 1.18 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Sidebar Manager Light versions = 1.18...

PT-2025-14979 · Piotnet · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor versions 2.4.34 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...

WordPress Countdown & Clock plugin <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion vulnerability

Unauthenticated Limited Local File Inclusion vulnerability discovered by mikemyers in WordPress Plugin Countdown & Clock versions = 2.8.9.1...

WordPress Uncanny Automator plugin <= 6.3.0.2 - Missing Authorization to Privilege Escalation vulnerability

Missing Authorization to Privilege Escalation vulnerability discovered by mikemyers in WordPress Plugin Uncanny Automator versions = 6.3.0.2...

WordPress Search engine keywords highlighter plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Search engine keywords highlighter versions = 0.1.3...

WordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pham Van Tam Patchstack Alliance in WordPress Plugin Booking Calendar and Notification versions = 4.0.3...