WordPress Kitring Theme <= 2.8 is vulnerable to Local File Inclusion

Software Kitring Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49426 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 373cf39af191 Credits Bonds Required privilege Unauthenticated Published 20...

@cbnventures/docusaurus-preset-nova (>=0.15.0, <=0.15.4), @changmao/reveal-md (6.1.4-chanmao0.0) +98 more potentially affected by CVE-2025-54881 via mermaid (>=11.0.0, <=11.9.0)

mermaid NPM version =11.0.0, =0.15.0, =15.1.25, =0.0.2, =13.34.0, =0.1.0, =12.81.0, =0.0.11, =13.46.0, =8.0.216, =12.28.0, =13.5.39, =12.28.0, =0.0.49, =1.1.183 and more Source cves: CVE-2025-54881 Source advisory: OSV:GHSA-7RQQ-PRVP-X9JH...

@bookshop/browser (3.11.0-rc.0), @bookshop/generate (3.11.0-rc.0) +24 more potentially affected by CVE-2025-55303 via astro (>=4.0.3, <=4.16.18)

astro NPM version =4.0.3, =0.40.5, =0.38.0, =0.38.0, =2.8.4, =0.2.0, =0.0.0-dev-20231211183354, =0.0.3, =0.0.3, =0.0.5, =0.0.1, =1.0.2, =1.0.9 - @thewebforge/astro-og-images 3.0.0 and more Source cves: CVE-2025-55303 Source advisory: OSV:GHSA-XF8X-J4P2-F749...

PT-2025-33862 · Unknown · Nginx-Defender

Name of the Vulnerable Software and Affected Versions: nginx-defender versions prior to 1.5.0 Description: nginx-defender deployments are susceptible to a configuration issue due to the presence of default credentials in example configuration files, such as config.yaml and docker-compose.yml. The...

Linux Distros Unpatched Vulnerability : CVE-2016-1678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote...

Workhorse Software Services, Inc. software prior to version 1.9.4.48019, default deployment is vulnerable to multiple issues.

Overview Workhorse Software Services, Inc municipal accounting software prior to version 1.9.4.48019 contains design flaws that could allow unauthorized access to sensitive data and facilitate data exfiltration. Specifically, database connection information is stored in plaintext alongside the...

Linux Distros Unpatched Vulnerability : CVE-2021-29060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Regular Expression Denial of Service ReDOS vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided...

WordPress weichuncai(WP伪春菜) plugin <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin weichuncaiWP伪春菜 versions = 1.5...

CVE-2025-54473 Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature...

PT-2025-33458 · WordPress · Elink – Embed Content

Name of the Vulnerable Software and Affected Versions: elink – Embed Content plugin for WordPress versions up to and including 1.1.0 Description: The elink – Embed Content plugin for WordPress is susceptible to malicious redirection due to insufficient restriction of URLs supplied through the eli...

PX4 Drone Autopilot 资源管理错误漏洞

PX4 Drone Autopilot is a PX4 drone autopilot open source by PX4 Autopilot. A resource management error vulnerability exists in PX4 Drone Autopilot version 1.15.4 and earlier, which stems from the MavlinkReceiver::handlemessageserialcontrol function mishandling the parameter mavlinkshell, which...

WordPress flexo-social-gallery Plugin <= 1.0006 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin flexo-social-gallery versions = 1.0006...

WordPress Print My Blog Plugin <= 3.27.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Print My Blog versions = 3.27.9...

WordPress Templatera Plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin Templatera versions = 2.3.0...

PT-2025-33400 · WordPress · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions n/a through 6.3.13 Description: Missing authorization allows exploiting incorrectly configured access control security levels in The Plus Addons for Elementor Page Builder Lite...

app.cash.backfila:client-misk (>=0.1.0, <=2023.11.24.141218-0357917), app.cash.backfila:client-misk-dynamodb (>=0.1.3-20210127.1838-76ab4fc, <=0.1.4-20210806.0204-5341f38) +1473 more potentially affected by CVE-2025-8916 via org.bouncycastle:bcprov-ext-jdk15on (>=1.47, <=1.70)

org.bouncycastle:bcprov-ext-jdk15on MAVEN version =1.47, =0.1.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =0.1.0, =2023.06.07.114626-93b9d6f, =0.1.0, =0.1.4-20220614.0152-5ae0eef, =3.0.1, =2.10.0-11-1, =1.1.5, =1.0.2,...

PT-2025-33064 · Code Projects · Job Diary

Name of the Vulnerable Software and Affected Versions: code-projects Job Diary version 1.0 Description: A SQL injection issue exists in code-projects Job Diary 1.0. The vulnerability affects an unknown functionality within the /user-apply.php file. Manipulation of the job title argument can lead ...

WordPress File Manager Pro plugin <= 1.8.9 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by tiborisaak in WordPress Plugin File Manager Pro versions = 1.8.9...

CVE-2025-8812

A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

Linux Distros Unpatched Vulnerability : CVE-2024-6284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended...