2025

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capab

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Imag

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for Wo

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (admi

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (admi

The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing cap

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password s

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in

The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its

The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its

Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit,

Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized u

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` en

@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in

@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.

@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Att

A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V

SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the para

SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_

SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /instal

Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the

Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custo

`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain condi

IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in

IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrar

An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value wit

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter

IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the syst

IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities res

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulat

Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configu

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Emb

Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-b

Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrect

Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Co

Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Acces

Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrect

Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to,

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the down

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’

app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.

The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allo