2025

Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Soc

Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web S

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Respons

Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calc

Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object In

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic t

Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Contr

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a writ

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data ou

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data in

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data ou

The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a

A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The man

A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some

The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a

The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads

In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size be

A vulnerability was found in pankajindevops scale up to 3633544a00245d3df88b6d13d9b3dd0f411be7f6. It has been classified

The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to

The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in al

The LTL Freight Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id

The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Ds_MerchantParameters'

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) p

The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versio

The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, a

The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

IBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.

IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 thro

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.r

binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-

vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the i

vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate

A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authentic

A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability aff

A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers

Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyU

Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/Use

MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\D

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows at

Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkw

Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.