2025

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_wei

An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute a

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers

FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controlle

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.ph

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute

picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses P

Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unl

In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commi

Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This is

IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an

Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, maliciou

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem

An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The

The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includin

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw c

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabili

In wifi display, there is a possible missing permission check. This could lead to local escalation of privilege with no

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored

The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the

The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the pag

The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the pag

The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back i

The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in

The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in th

The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the pa

The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page

The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in

The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back i

The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in t

The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi

The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when output

The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it ba

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a pa

The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode at

The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it bac

The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before ou

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories

Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which comp

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows i

Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR I