2025

Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an store

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover,

A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue

A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is a

A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function o

Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.

A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of th

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in rem

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthentica

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerabili

The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forg

The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file upl

Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impers

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Str

The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including,

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to,

The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions

The Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress is vulnerable to Stored Cross-Site Scr

The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorizati

The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uplo

The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of da

The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing

The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in a

The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all

The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to

The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accor

The Gutenify – Visual Site Builder Blocks & Site Templates. plugin for WordPress is vulnerable to Stored Cross-Site Scri

A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to a

A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges

A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privile

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly saniti

SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability t

The Category and Product Woocommerce Tabs plugin for WordPress is vulnerable to Local File Inclusion in all versions up

The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclu

The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all ve

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and inc

The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1

The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' paramet

The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,

The Like-it plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.

The Permalinks Cascade plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The WP Admin Microblog plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMess

The everviz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `everviz` shortcode attributes in