MiracleLinux 4 : bind-9.8.2-0.68.8.0.2.rc1.AXS4 (AXBA:2021-1480:02)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2021-1480:02 advisory. - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the...

MiracleLinux 4 : ibutils-1.5.7-8.AXS4, libibverbs-1.1.7-1.AXS4, libmlx4-1.0.5-4.AXS4.1, librdmacm-1.0.17-1.AXS4, mpit (AXSA:2014-192:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-192:01 advisory. ibutils: provides IB network and path diagnostics. infinipath-psm: The PSM Messaging API, or PSM API, is QLogic's low-level user-level communications...

MiracleLinux 8 : qt5-qtbase-5.12.5-6.el8, qt5-qttools-5.12.5-2.el8, qt5-qtwebsockets-5.12.5-2.el8 (AXSA:2021-1450:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1450:01 advisory. qt: XML entity expansion vulnerability CVE-2015-9541 qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages...

Curl 7.58.0 < 8.18.0 Multiple Vulnerabilities

The version of curl installed on the remote host is 7.58 = 8.17.0. It is, therefore, affected by multiple vulnerabilities when built with the libssh backend: - A key passphrase bypass vulnerability exists where curl wrongly authenticates using a locally running SSH agent even when specifically...

CVE-2026-0725

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

1Panel cross-site scripting vulnerabilities

1Panel is an open-source Linux server operation and management panel developed by the 1Panel community. Versions of 1Panel prior to 1.10.33-lts, as well as versions 2.0.16 and earlier, have a cross-site scripting vulnerability. This vulnerability stems from insufficient content cleaning when the...

PT-2026-3528

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-13 and 6.9.13-38 Description ImageMagick is a free and open-source software used for editing and manipulating digital images. A heap buffer overflow vulnerability exists in the XBM image decoder ReadXBMImage...

Exploit for CVE-2025-36911

This is not an exploit for CVE-20...

CVE-2025-14982

The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the...

CVE-2025-13725 Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter

The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 1.0.1. This is due to insufficient path validation in the server-side rendering of the thim-blocks/icon block. This make...

Exploit for CVE-2025-8489

100-days-challenge-day-21--WP scan WP Scan helped identify co...

CVE-2025-14450

The CVE CVE-2025-14450 affects Wallet System for WooCommerce (WordPress) where a missing capability check in change_wallet_fund_request_status_callback allowed authenticated users with Subscriber+ privileges to modify wallet withdrawal requests and arbitrarily alter balances in versions up to 2.7...

CVE-2025-14075

CVE-2025-14075 affects the WP Hotel Booking plugin for WordPress (versions up to and including 2.2.7). The vulnerability exposes the unauthenticated AJAX action hotel_booking_fetch_customer_info without proper capability checks, relying only on a nonce. This allows unauthenticated attackers to re...

SUSE CVE-2017-18893

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS...

WordPress plugin Church Admin code vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

WordPress plugin Advanced Ads – Ad Manager & AdSense SQL injection vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

WordPress plugin: Integrating Dynamics 365 CRM – Cross-site Script Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

Bastillion command injection vulnerability

Bastillion is an open-source key management tool developed by bastillion-io. Versions of Bastillion 4.0.1 and earlier contained a command injection vulnerability. This vulnerability stemmed from incorrect operations on the Public Key Management System component in the file...

CVE-2020-36926

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique...

GHSA-232V-J27C-5PP6 REC in MCPJam inspector due to HTTP Endpoint exposes

Summary MCPJam inspector is the local-first development platform for MCP servers. The Latest version Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leadi...