WordPress Radio Station Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress Radio Station, which stems from the application not properly handling user-submitted form data, and no detail...

Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An elevation of privilege vulnerability exists in Microsoft Edge Chromium-based Update, which can be exploited by an attacker to gain SYSTEM privileges...

WordPress Easy restaurant menu manager cross-site scripting vulnerability

WordPress Easy restaurant menu manager is a WordPress plugin for managing restaurant menus , the main features include uploading and editing restaurant menus online and embedding them into the website through short codes or links. A cross-site scripting vulnerability exists in WordPress Easy...

WordPress Red Art Code Injection Vulnerability

WordPress Red Art is a theme designed for the art field, mainly used to create artist portfolios, galleries, photography exhibitions, tattoo studios and other art websites. WordPress Red Art suffers from a code injection vulnerability that stems from deserializing untrustworthy data, which can be...

WordPress Uncode Core Cross-Site Scripting Vulnerability

WordPress Uncode Core is a creative multipurpose theme for the WordPress platform. WordPress Uncode Core suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and output escaping, which can be exploited by an attacker to steal user session information by...

WordPress Tournament Bracket Generator Cross-Site Scripting Vulnerability

WordPress Tournament Bracket Generator is a plugin for generating fixture maps for the knockout stages of tournaments. A cross-site scripting vulnerability exists in WordPress Tournament Bracket Generator, which stems from insufficient input cleanup and escaping, and can be exploited by an attack...

WordPress ads pro SQL injection vulnerability (CNVD-2025-15421)

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro suffers from a SQL injection vulnerability, which stems...

MongoDB Server Log Information Disclosure Vulnerability (CNVD-2025-15517)

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server versions prior to 8.0.5,...

WordPress Magic Buttons for Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Magic Buttons for Elementor that stems from insufficient input cleanup and output escaping of user-supplied...

WordPress ads pro SQL injection vulnerability (CNVD-2025-15420)

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro suffers from a SQL injection vulnerability that stems...

WordPress Magic Buttons for Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Magic Buttons for Elementor, which stems from insufficient input cleanup and output escaping of user-supplied...

WordPress web-cam cross-site scripting vulnerability

WordPress web-cam is a plugin for integrating instant photo taking feature in WordPress website, by calling user's device camera to realize real-time photo taking feature. WordPress web-cam suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and escaping,...

WordPress WP Front-end login and register cross-site scripting vulnerability

WP Front-end login and register is a WordPress front-end account management plugin, mainly used in the front-end of the site to achieve user registration, login and password change functions, without having to jump to the WordPress background. WordPress WP Front-end login and register has a...

WordPress ads pro SQL Injection Vulnerability

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro suffers from a SQL injection vulnerability, which stems...

TOTOLINK N300RH Denial of Service Vulnerability

TOTOLINK N300RH is a long-range wireless router from China's TOTOLINK, supporting the IEEE 802.11n standard with a maximum wireless transmission rate of 300Mbps. A denial of service vulnerability exists in the TOTOLINK N300RH, which originates from the incorrect operation of the parameter url in...

WordPress ads pro SQL Injection Vulnerability

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro suffers from a SQL injection vulnerability, which stems...

Google ChromeOS Elevation of Privilege Vulnerability

Google ChromeOS is an operating system from the American company Google. Google ChromeOS suffers from an elevation of privilege vulnerability that originates from debug shell accessibility, which can be exploited by an attacker to access restricted system functions and data via elevation of...

WordPress Vikinger Path Traversal Vulnerability

WordPress Vikinger is a WordPress blog theme developed by a foreign developer. WordPress Vikinger has a path traversal vulnerability that stems from insufficient file path validation in the function vikingerdeleteactivitymediaajax, which can be exploited by an attacker to tamper with the system...

WordPress ads pro cross-site request forgery vulnerability

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro has a cross-site request forgery vulnerability, which...

UTT Progressive 750W Unauthenticated Password Change Vulnerability

The UTT Progress 750W is an enterprise-grade dual-band wireless router from Atech Technology UTT, which is aimed at SMB network environments. The UTT Progress 750W suffers from an unauthenticated password change vulnerability, which originates from an unauthenticated password change due to...

MongoDB Server Resource Management Error Vulnerability (CNVD-2025-15516)

MongoDB Server is a distributed document database system from MongoDB. A resource management error vulnerability exists in MongoDB Server versions prior to 8.0 through 8.0.10 that stems from inefficient memory management for internal operations. An attacker could exploit this vulnerability to cau...

WordPress Forminator Forms Code Issue Vulnerability

WordPress Forminator Forms is a powerful free form builder plugin that supports the creation of many types of interactive forms. WordPress Forminator Forms suffers from a code issue vulnerability that stems from deserializing untrusted inputs in the function entrydeleteuploadfiles, which can be...

WordPress Soumettre.fr Authorization Issues Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An authorization issue vulnerability exists in WordPress Soumettre.fr, which stems from an improper authorization check in the makesignature function, and can be exploited ...

MongoDB Server Authorization Issues Vulnerability (CNVD-2025-15515)

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server versions prior to 8.0.7,...

MongoDB Server Resource Management Error Vulnerability

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server versions prior to 6.0.23,...

WordPress WP Optimize By xTraffic Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress WP Optimize By xTraffic that stems from the application not properly validating user-submitted code, which can be exploited b...

UTT Progressive 750W Buffer Overflow Vulnerability (CNVD-2026-02644)

The UTT Progress 750W is an enterprise-grade dual-band wireless router from Atech Technology UTT, which is aimed at SMB network environments. The UTT Progress 750W suffers from a buffer overflow vulnerability, which originates from the operation of the strcpy function in the file /goform/setSysAd...

WordPress GC Social Wall Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress GC Social Wall, which stems from insufficient input cleanup and output escaping, and can be exploited by an attacke...

WordPress Lead Form Data Collection to CRM plugin elevation of privilege vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An elevation of privilege vulnerability exists in the WordPress Lead Form Data Collection to CRM plugin, which stems from a missing capability check in the function...

Local Services Search Engine Management System SQL Injection Vulnerability

Local Services Search Engine Management System is a local services search engine management system. Local Services Search Engine Management System suffers from a SQL injection vulnerability, which originates from the lack of validation of the editid parameter in the file...

Simple forum register1.php file SQL Injection Vulnerability

Simple forum is a simple forum. Simple forum suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter User in the file /register1.php. An attacker can exploit this vulnerability to execute illegal SQL commands to...

Simple forum signin.php file SQL injection vulnerability

Simple forum is a simple forum. Simple forum suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter User in the file /signin.php. An attacker can exploit this vulnerability to execute illegal SQL commands to ste...

Medical Card Generation System Manage Card Function Cross-Site Request Forgery Vulnerability

Medical Card Generation System is a medical card generation system. The Medical Card Generation System suffers from a cross-site request forgery vulnerability that stems from the lack of CSRF protection in the Manage Card feature, which can be exploited by an attacker to send a simple GET request...

WordPress Plugin Abandoned Contact Form Has Unspecified Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin Abandoned Contact Form, which stems from a lack ...

HDF5 src/H5Centry.c file buffer overflow vulnerability

HDF5 is a library of HDF open source . HDF5 version 1.14.6 there is a buffer overflow vulnerability , the vulnerability stems from the file src/H5Centry.c function H5Cflushsingleentry fails to correctly validate the length of the input data size , a remote attacker can use this vulnerability on t...

Library System Code Issue Vulnerability

Library System is a library system. Library System has a code issue vulnerability that stems from the lack of valid validation of uploaded files by the parameter image in the file /profile.php. An attacker can exploit this vulnerability to upload malicious files...

Simple forum forum_viewfile.php file SQL Injection Vulnerability

Simple forum is a simple forum. Simple forum suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Name in the file /forumviewfile.php. An attacker can exploit this vulnerability to execute illegal SQL commands...

WordPress Additional Order Filters for WooCommerce plugin Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Additional Order Filters for WooCommerce plugin, which stems from the WEB application not adequately verifying...

Library System profile.php File SQL Injection Vulnerability

Library System is a library system. The Library System suffers from a SQL injection vulnerability that originates from a lack of validation of externally-entered SQL statements in the parameter phone in the file /profile.php. An attacker can exploit this vulnerability to execute illegal SQL...

WordPress Add & Replace Affiliate Links for Amazon plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Add & Replace Affiliate Links for Amazon plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and...

D-Link DIR-823-Pro Improper Privilege Control Vulnerability

D-Link DIR-823-Pro is a dual-band intelligent wireless router with quad-antenna design, supporting 802.11ac Gigabit Wi-Fi technology and wireless rate up to 1200Mbps, which can meet the high bandwidth demand for HD video playback, online games and so on. The D-Link DIR-823-Pro suffers from an...

Simple forum forum_edit.php file SQL Injection Vulnerability

Simple forum is a simple forum. Simple forum suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in parameter iii in file /forumedit.php. An attacker can exploit this vulnerability to execute illegal SQL commands to steal...

Simple forum code issue vulnerability

Simple forum is a simple forum. Simple forum has a code issue vulnerability that stems from the lack of valid validation of uploaded files in the parameter File in the file /forum1.php. An attacker can exploit this vulnerability to upload malicious files...

WordPress Aioseo Multibyte Descriptions plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Aioseo Multibyte Descriptions plugin, which stems from a WEB application that does not adequately validate tha...

WordPress A/B Testing for WordPress plugin cross-site scripting vulnerability

WordPress A/B Testing for WordPress plugin is a plugin for A/B testing in WordPress websites, which is mainly used to help optimize website conversions by comparing the effects of different page elements such as titles, button colors, content, etc.. The WordPress A/B Testing for WordPress plugin...

Apache Seata Deserialization Vulnerability

Apache Seata is the United States Apache Apache Foundation of a microservices architecture in the United States to provide high-performance and easy to use distributed transaction services in the open source project . A deserialization vulnerability exists in Apache Seata versions prior to 2.0.0 ...

Library System student-issue-book.php File SQL Injection Vulnerability

Library System is a library system. The Library System suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter reg in the file /student-issue-book.php. An attacker can exploit this vulnerability to execute illeg...

Simple forum forum1.php file SQL Injection Vulnerability

Simple forum is a simple forum. Simple forum suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter File in the file /forum1.php. An attacker can exploit this vulnerability to execute illegal SQL commands to ste...

Medical Card Generation System Cross-Site Scripting Vulnerability

Medical Card Generation System is a medical card generation system. A cross-site scripting vulnerability exists in Medical Card Generation System, which stems from improper cleanup of the contact page name field and can be exploited by an attacker to inject malicious JavaScript...

Simple forum /forum_edit1.php file cross-site scripting vulnerability

Simple forum is a simple forum. Simple forum suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter text in the file /forumedit1.php, which can be exploited by an attacker to execute arbitrary Web scrip...