CVE-2025-69412

KDE messagelib vulnerable before version 25.11.90 due to ignoring SSL errors for threatMatches:find in the Google Safe Browsing Lookup API, potentially allowing spoofed threat data. The issue is mitigated by updating to KDE messagelib 25.11.90 or applying the vendor security patch described in th...

CVE-2023-7332

PocketMine-MP (server software for Minecraft: Bedrock) is affected in versions prior to 4.18.1 by an improper input validation flaw in inventory transaction handling. The root cause is inadequate validation in the handling of dropped items during an inventory transaction, which allows a remote at...

CVE-2025-53235

The CVE-2025-53235 entry concerns the WordPress Easy Social plugin (osuthorpe Easy Social) versions up to 1.3. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation. Impact is reflected in the ability for an attacker to...

CVE-2025-52739

CVE-2025-52739 affects WordPress Sala theme versions up to 1.1.3. The root cause is improper neutralization of input during web page generation, enabling Reflected XSS. Impact described in multiple feeds: reflected XSS affecting Sala from n/a through 1.1.3 with published CVSS 3.1 vector (AV:N/AC:...

CVE-2025-47566

CVE-2025-47566 refers to a Cross‑Site Scripting vulnerability in the ZoomSounds WordPress plugin. The description and connected docs confirm it is a Reflected XSS caused by improper neutralization of input during web page generation, affecting ZoomSounds:

CVE-2025-30628

CVE-2025-30628 affects the AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer). The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands, affecting plugin versions up to and including 1.2. The CVSS v3.1 base score is 8.5 ...

CVE-2025-28949

CVE-2025-28949 for Mediabay - WordPress Media Library Folders: an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability allowing Blind SQL Injection in Mediabay = 1.5 or patch-level fixes) and confirm the affected software is the Mediabay plugin for Word...

CVE-2025-66144

CVE-2025-66144 describes a Missing Authorization vulnerability in Merkulove Worker for Elementor affecting Worker for Elementor up to version 1.0.10 due to misconfigured access control. CVSS 3.1 base score 5.4 (Medium); attack vector NETWORK, complexity LOW, privileges Required LOW, no user inter...

CVE-2025-66145

Technical details about CVE-2025-66145 are not provided in the supplied documents. No information on affected versions, root cause, impact, or fixes is present here. Monitor for updates.

CVE-2025-66146

Technical details for CVE-2025-66146 are not publicly provided in the supplied documents; monitor for updates.

CVE-2025-66148

Technical details for CVE-2025-66148 are not disclosed in the provided connected documents. The supplied materials do not specify affected versions, root cause, impact, or remediation. Monitor official CVE entries for updates and published fixes.

CVE-2021-47743

The CVE-2021-47743 entry concerns COMMAX Biometric Access Control System 1.0.0 with an unauthenticated reflected XSS in cookie parameters CMX_ADMIN_NM and CMX_COMPLEX_NM. The vulnerability allows injection of HTML/JavaScript to run in a victim’s browser session. Documents do not specify affected ...

CVE-2021-47740

CVE-2021-47740 affects KZTech JT3500V 4G LTE CPE 2.0.1. The issue is a session management vulnerability where the device accepts and reuses old session credentials without proper expiration, due to weak session handling. Impact stated in sources includes unauthorized access and potential compromi...

CVE-2021-47725

CVE-2021-47725 affects STVS ProVision 5.9.10. The vulnerability is an authenticated, reflected cross-site scripting flaw in the HTML context via the POST parameter named “files,” where input is not properly validated. Exploitation allows an attacker with credentials to inject arbitrary HTML/JS th...

CVE-2021-47747

CVE-2021-47747 affects meterN 1.2.3 and describes an authenticated remote code execution vulnerability in admin_meter2.php and admin_indicator2.php. The issue allows an attacker to submit POST parameters COMMANDx and LIVECOMMANDx to execute arbitrary system commands with administrative privileges...

CVE-2021-47745

CVE-2021-47745 affects Cypress Solutions CTM-200 firmware 2.7.1. The authenticated command injection occurs in the firmware upgrade script via the fw_url parameter in ctm-config-upgrade.sh, allowing a remote attacker to inject and execute arbitrary commands with root privileges. CVSS metrics indi...

CVE-2021-47741

The CVE-2021-47741 entry concerns the ZBL EPON ONU Broadband Router V100R001. The vulnerability is a privilege-escalation issue that allows limited administrative users to elevate access by calling configuration endpoints. Exploitation is described as possible through access to the configuration ...

CVE-2021-47742

CVE-2021-47742 affects Epic Games Psyonix Rocket League

CVE-2021-47726

CVE-2021-47726 affects NuCom 11N Wireless Router firmware 5.07.90. The vulnerability is a privilege-escalation flaw in the configuration backup endpoint that allows non-privileged users to retrieve the admin password. An attacker can send a crafted HTTP GET request to the backup configuration pag...

CVE-2020-36903

CVE-2020-36903 affects Selea CarPlateServer 4.0.1.6, which is vulnerable to an unquoted service path in the Windows service configuration. The issue allows a local user to potentially execute code with LocalSystem privileges during startup or reboot by placing a malicious binary in the system roo...