2025

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vu

A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulner

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missi

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious act

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPre

The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions u

The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7

The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the

The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting i

The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the

The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as we

The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outpu

The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vul

Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerabilit

Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in th

Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A

The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of dat

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordi

The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability

The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to u

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missin

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due t

The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultbloc

Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traver

Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a nul

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, the

Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers

Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated at

Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JW

Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated

Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated at

A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. This affects an u

The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanit

A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without an

macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do no

OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored

SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures w

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirec