2025

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor wit

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was a

IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery

The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for Wo

OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell comma

The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pr

The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5

The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' paramet

The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' pa

The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab

The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,

The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing f

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9

The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology I

The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabilit

The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil

The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and inc

The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provid

The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scr

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress the

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.ph

The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which d

Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attac

Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2

The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate pa

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter i

The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 th

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerabilit

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerabilit

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerabilit

An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software v

A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The

A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software ve

A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. T

Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a

Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network

Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerab

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnera

Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue a

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1

The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with