WordPress RestroPress plugin <= 3.2.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin RestroPress versions = 3.2.4.2...

CVE-2025-36229

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers...

WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Doan Dinh Van in WordPress Plugin Event Organiser versions = 3.12.8...

Exploit for CVE-2025-68613

n8n CVE-2025-68613 — Lab Disclaimer This repository conta...

CVE-2025-67729 lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()

LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load is called without the weightsonly=True parameter when loading model checkpoint files. This allows an attacker to execute...

CVE-2025-68156 affecting package coredns for versions less than 1.11.4-12

CVE-2025-68156 affecting package coredns for versions less than 1.11.4-12. A patched version of the package is available...

hacker-man

Hacker Man - Vulnerable Web Applications Lab A collection of...

3scale (>=0.3.2, <=0.6.2), 3scale-cm (0.5.1) +188 more potentially affected by CVE-2025-25341 via libxmljs (>=1.0.9, <=1.0.11)

libxmljs NPM version =1.0.9, =0.3.2, =0.3.2, =1.10.4, =1.8.1, =1.8.8, =1.0.0, =1.1.0, =0.1.0, =250.1010.0, =250.1018.0, =252.1021.0 and more Source cves: CVE-2025-25341 Source advisory: OSV:GHSA-JV72-59WQ-8RXM...

3loc (>=0.1.0, <=0.4.0), 3scale (>=0.2.0, <=0.6.2) +651 more potentially affected by CVE-2025-25341 via libxmljs (>=0.4.1, <=1.0.11)

libxmljs NPM version =0.4.1, =0.1.0, =0.2.0, =0.3.2, =0.0.1, =4.0.1, =1.10.4, =1.8.1, =1.5.8, =1.5.1, =1.8.3, =1.0.1, =1.0.0, =4.5.1 and more Source cves: CVE-2025-25341 Source advisory: SNYK:JS-LIBXMLJS-14723210...

CVE-2025-36230

CVE-2025-36230 - IBM Aspera Faspex HTML injection is documented in the IBM Security Bulletin. Faspex 5.0.0–5.0.14.1 allows a remote attacker to inject malicious HTML that executes in the victim’s browser within the hosting site’s security context. Mitigation: upgrade Faspex to version 5.0.14.2 (L...

WordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Brands for WooCommerce versions = 3.8.6.3...

WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Medicalequipment versions = 1.0.9...

WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MD ISMAIL in WordPress Plugin CubeWP versions = 1.1.27...

WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by MD ISMAIL in WordPress Plugin WP Project Manager versions = 3.0.1...

OIBSIP_-SQL-Injection-on-DVWA-Low-Security-

This project demonstrates a basic SQL Injection vulnerability us...

Cross-site Scripting (XSS)

Overview httpbin is a HTTP Request and Response Service Affected versions of this package are vulnerable to Cross-site Scripting XSS via the endpoint /base64 which does not encode user-controllable parameters when outputting them on the current page. An attacker can inject and execute arbitrary...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to a Directory Traversal flaw during the processing of DNS TXT record queries . The root cause is the insecure use of os.path.join to concatenate a requested URL (or a portion of it) directly with a base path. This flaw allows for directory traversal or absolute p...

PT-2025-53814

Name of the Vulnerable Software and Affected Versions weDevs WP Project Manager versions through 3.0.1 Description A flaw exists in weDevs WP Project Manager that allows for the retrieval of embedded sensitive data. The issue involves the insertion of sensitive information into sent data...

lmdeploy code-related vulnerabilities

lmdeploy is an InternLM open source toolkit for compressing, deploying and servicing LLM. A code issue vulnerability exists in versions of lmdeploy prior to 0.11.1 that stems from loading model checkpoint files without using the weightsonly parameter, which could lead to an attacker executing...

PT-2025-53607

Name of the Vulnerable Software and Affected Versions StreamVault versions prior to 251126 Description StreamVault is a video download integration solution. A Remote Code Execution RCE issue exists in the stream-vault application SpiritApplication. The application does not properly validate...