115080 matches found
PT-2025-48550
Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.86.0 Frappe versions prior to 14.99.2 Description Frappe, a full-stack web application framework, had requests vulnerable to path traversal attacks in versions prior to 15.86.0 and 14.99.2. This allowed retrieval of...
PT-2025-48609
Name of the Vulnerable Software and Affected Versions BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library versions prior to 2.2.14 Description The BlockArt Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting due to...
PT-2025-48608
Name of the Vulnerable Software and Affected Versions Cost Calculator Builder plugin for WordPress versions up to and including 3.6.3 Description The Cost Calculator Builder plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the...
PT-2025-48665
Name of the Vulnerable Software and Affected Versions WP Directory Kit versions up to and including 1.4.6 Description The WP Directory Kit plugin for WordPress is susceptible to SQL Injection through the search parameter. This is due to inadequate input sanitization and insufficient preparation o...
Apache Struts security vulnerabilities
Apache Struts is an open source project of the Apache USA Foundation, a set of open source MVC frameworks for creating enterprise Java web applications, offering two main versions of the framework product, Struts 1 and Struts 2. A security vulnerability exists in Apache Struts versions 2.0.0...
WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Cart Weight for WooCommerce versions = 1.9.11...
CVE-2025-66420
Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...
CVE-2025-66433
HTCondor Access Point (HTCondor) before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. The earliest affected version is 24.7.3. Fixes are available in 24.12.14, 25.0.3, and 25.3.1. Affected platforms and versions are corroborated by ...
WordPress TNC Toolbox: Web Performance plugin <= 2.0.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin TNC Toolbox: Web Performance versions = 2.0.4...
CVE-2025-66289 OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change
OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, o...
EUVD-2025-199905
OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, o...
CVE-2025-66289 OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change
OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, o...
EUVD-2025-199899
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer. This issue has been...
WordPress Reuters Direct plugin <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset vulnerability
Missing Authorization to Unauthenticated Settings Reset vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Reuters Direct versions = 3.0.0...
WordPress Analytics Germanized for Google Analytics plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin Analytics Germanized for Google Analytics versions = 1.6.2...
WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by NumeX in WordPress Plugin Subscriptions & Memberships for PayPal versions = 1.1.7...
WordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin FluentCommunity versions = 2.0.0...
Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Cross-Site Scripting (XSS), specifically Mutation XSS (mXSS) due to dompurify
Summary dompurify is used by IBM watsonx Orchestrate Developer Edition as part of image: wxo-builder-ui Vulnerability Details CVEID:CVE-2025-26791 DESCRIPTION: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting mXSS...
Vulnerabilities fixed in Mattermost
Mattermost has fixed vulnerabilities in versions 11.0.x through 11.0.3, 10.12.x through 10.12.1, 10.11.x through 10.11.4 and 10.5.x through 10.5.12. The vulnerabilities allow an authenticated attacker to take over an account via a carefully crafted email address during the authentication process...