2025

The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Displa

The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via

The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to

The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all ve

The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability

The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege e

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in

The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalat

The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cro

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versio

The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch

The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capab

The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on th

The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. Th

The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, an

The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, an

The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. Th

CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.

CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter.

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.

A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to exe

A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authenticati

A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across

Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Sn

Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers

An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira D

Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.

HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing

A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe".

The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and s

A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attac

During login to the web server in "Sante PACS Server.exe", OpenSSL function EVP_DecryptUpdate is called to decrypt the u

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to a

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard code

Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as

Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to

A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw i

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft us

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated use

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other p

A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A

A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A

A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnera