CVEs published April 17, 2025
314 CVEs were published on April 17, 2025: 38 critical, 201 high.
- Published
- 314
- Critical
- 38
- High
- 201
- Medium
- 62
- Low
- 13
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- Linux
- 5
- JetBrains Toolbox App
- 4
- GitHub Enterprise Server
- 3
- SUNNET Technology Co. Wisdom Master Pro
- 3
- Ultimate Dashboard
- 3
- benjaminprojas WP Editor
- 2
- Dell ECS
- 2
- DragonflyDB Dragonfly
- 2
- HCL Software HCL MyXalytics
- 2
- Hive Support
- 2
Critical 38
- CVE-2025-27282WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Upload vulnerabilityrockgod100 Theme File Duplicator
- CVE-2025-27286WordPress Saoshyant Slider Plugin <= 3.0 - PHP Object Injection vulnerabilitysaoshyant1994 Saoshyant Slider
- CVE-2025-27287WordPress SS Quiz Plugin <= 2.0.5 - PHP Object Injection vulnerabilityssvadim SS Quiz
- CVE-2025-27302WordPress CHATLIVE plugin <= 2.0.1 - SQL Injection vulnerabilityClaudio Adrian Marrero CHATLIVE
- CVE-2025-31380WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerabilityvideowhisper Paid Videochat Turnkey Site
- CVE-2025-32572WordPress Kata Plus Plugin <= 1.5.3 - PHP Object Injection vulnerabilityClimax Themes Kata Plus
- CVE-2025-32583WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerabilitytermel PDF 2 Post
- CVE-2025-32626WordPress JS Job Manager plugin <= 2.0.2 - SQL Injection vulnerabilityJoomSky JS Job Manager
- CVE-2025-32636WordPress Local Magic plugin <= 2.9.0 - SQL Injection vulnerabilitymatthewrubin Local Magic
- CVE-2025-32648WordPress Projectopia plugin <= 5.1.24 - Privilege Escalation vulnerabilityProjectopia
- CVE-2025-32652WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerabilitysolacewp Solace Extra
- CVE-2025-32658WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerabilitywpWax HelpGent
- CVE-2025-32660WordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerabilityJoomSky JS Job Manager
- CVE-2025-32665WordPress Office Locator plugin <= 1.3.0 - SQL Injection vulnerabilityWebbyTemplate Office Locator
- CVE-2025-32682WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload VulnerabilityRomanCode MapSVG
- CVE-2025-39550WordPress FluentCommunity plugin <= 1.2.15 - PHP Object Injection VulnerabilityShahjahan Jewel FluentCommunity
- CVE-2025-39551WordPress FluentBoards plugin <= 1.47 - PHP Object Injection VulnerabilityMahmudul Hasan Arif FluentBoards
- CVE-2025-39587WordPress Cost Calculator Builder plugin <= 3.2.65 - SQL Injection VulnerabilityStylemix Cost Calculator Builder
- CVE-2025-39588WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2025-39595WordPress Quentn WP plugin <= 1.2.8 - SQL Injection VulnerabilityQuentn.com Quentn WP
- CVE-2025-39596WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation VulnerabilityQuentn.com Quentn WP
- CVE-2025-22655WordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerabilityCaio Web Dev CWD – Stealth Links
- CVE-2025-39436WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerabilityaidraw I Draw
- CVE-2025-3651Command Injection in iManage Work Desktop for Mac's Agent ServiceiManage Work Desktop for Mac
- CVE-2025-3113Improper Access Control in Delphix Masking EnginePerforce Delphix
- CVE-2025-31340Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP ProgramSUNNET Technology Co. Wisdom Master Pro
- CVE-2024-53924Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginnipycel
- CVE-2024-56518Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML docum
- CVE-2025-28009A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20.
- CVE-2025-29040An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c
- CVE-2025-29041An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c
- CVE-2025-29042An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c
- CVE-2025-29043An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234
- CVE-2025-29044Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key v
- CVE-2025-29045Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key value
- CVE-2025-29046Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPS
- CVE-2025-29047Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hidd
- CVE-2025-29662A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote netw
High 201
- CVE-2025-3246Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggersGitHub Enterprise Server
- CVE-2025-3509Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege EscalationGitHub Enterprise Server
- CVE-2021-47670can: peak_usb: fix use after free bugsLinux
- CVE-2021-47669can: vxcan: vxcan_xmit: fix use after free bugLinux
- CVE-2021-47668can: dev: can_restart: fix use after free bugLinux
- CVE-2025-2947IBM i privilege escalationIBM i
- CVE-2025-43015In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfacesJetBrains RubyMine
- CVE-2025-43012In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possibleJetBrains Toolbox App
- CVE-2025-23443WordPress Author Showcase plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityClaire Ryan Author Showcase
- CVE-2025-23448WordPress visualslider Sldier plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydastan800 visualslider Sldier
- CVE-2025-23782WordPress TotalContest Lite Plugin <= 2.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityTotalSuite TotalContest Lite
- CVE-2025-23855WordPress SpiderDisplay plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityfyljp SpiderDisplay
- CVE-2025-23858WordPress Custom Users Order Plugin <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityHiren Patel Custom Users Order
- CVE-2025-24539WordPress DeBounce Email Validator plugin <= 5.6.5 - Reflected Cross Site Scripting (XSS) vulnerabilityDeBounce Email Validator
- CVE-2025-24548WordPress Autoglot – Automatic WordPress Translation plugin <=2.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityAutoglot – Automatic WordPress Translation
- CVE-2025-24553WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerabilityAkadrama Shipping with Venipak for WooCommerce
- CVE-2025-24586WordPress Shipment Tracker for Woocommerce plugin <= 1.4.23 - Cross Site Scripting (XSS) vulnerabilitybitsstech Shipment Tracker for Woocommerce
- CVE-2025-24619WordPress WP Log Action Plugin <= 0.51 - Reflected Cross Site Scripting (XSS) vulnerabilitywebheadcoder WP Log Action
- CVE-2025-24621WordPress Arconix Shortcodes plugin <= 2.1.15 - Reflected Cross Site Scripting (XSS) vulnerabilitytychesoftwares Arconix Shortcodes
- CVE-2025-24624WordPress HT Event – WordPress Event Manager Plugin for Elementor Plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityDevItems HT Event
- CVE-2025-24637WordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilitySyed Balkhi Beacon Lead Magnets and Lead Capture
- CVE-2025-24640WordPress Empty Tags Remover Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDan-Lucian Stefancu Empty Tags Remover
- CVE-2025-24645WordPress Eazy Under Construction Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRob Scott Eazy Under Construction
- CVE-2025-24655WordPress Wishlist Plugin <= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerabilityPickPlugins Wishlist
- CVE-2025-24670WordPress Term Taxonomy Converter Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityDhanendran Rajagopal Term Taxonomy Converter
- CVE-2025-24745WordPress Classified Listing plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRadiusTheme Classified Listing
- CVE-2025-24752WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2025-27284WordPress Flagged Content Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitydivspark Flagged Content
- CVE-2025-27285WordPress Easy Form by AYS Plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerabilityAys Pro Easy Form
- CVE-2025-27288WordPress File Icons Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityBjornW File Icons
- CVE-2025-27289WordPress Restrict Taxonomies Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityAntoine Guillien Restrict Taxonomies
- CVE-2025-27291WordPress Photo Gallery – Image Gallery Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityuxgallery WordPress Photo Gallery – Image Gallery
- CVE-2025-27292WordPress WPYog Documents Plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityPoppinsDigital.com WPYog Documents
- CVE-2025-27293WordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywebparexapp Shipmozo Courier Tracking
- CVE-2025-27295WordPress Live css plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitywpion Live css
- CVE-2025-27308WordPress WP Video Posts plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilitycmstactics WP Video Posts
- CVE-2025-27309WordPress flickr-slideshow-wrapper Plugin <= 5.4.6 - Cross Site Scripting (XSS) vulnerabilityJeannot Muller flickr-slideshow-wrapper
- CVE-2025-27313WordPress Google Maps GPX Viewer Plugin <= 3.6 - Reflected Cross Site Scripting (XSS) vulnerabilityBernd Altmeier Google Maps GPX Viewer
- CVE-2025-27314WordPress Kush Micro News Plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityKush Sharma Kush Micro News
- CVE-2025-27319WordPress User List plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityivan82 User List
- CVE-2025-27322WordPress QR Code for WooCommerce Plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityBappa Mal QR Code for WooCommerce
- CVE-2025-27324WordPress 17TRACK for WooCommerce Plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability17TRACK for WooCommerce
- CVE-2025-27333WordPress Protected wp-login Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityalvego Protected wp-login
- CVE-2025-27337WordPress Fontsampler Plugin <= 0.4.14 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilitykontur Fontsampler
- CVE-2025-27338WordPress List Urls Plugin <= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilitygraphems List Urls
- CVE-2025-27343WordPress WooCommerce HTML5 Video Plugin <= 1.7.10 - Reflected Cross Site Scripting (XSS) vulnerabilityWebilop WooCommerce HTML5 Video
- CVE-2025-27345WordPress Booking Ultra Pro Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerabilityDeetronix Booking Ultra Pro
- CVE-2025-27346WordPress Rebuild Permalinks Plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerabilitygerrygooner Rebuild Permalinks
- CVE-2025-27354WordPress Simple Email Subscriber plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityphil88530 Simple Email Subscriber
- CVE-2025-31006WordPress Activity Reactions For Buddypress plugin <= 1.0.22 - Reflected Cross Site Scripting (XSS) vulnerabilityarete-it Activity Reactions For Buddypress
- CVE-2025-31018WordPress FireDrum Email Marketing plugin <= 1.64 - Reflected Cross Site Scripting (XSS) vulnerabilityFireDrum Email Marketing
- CVE-2025-31030WordPress Ray Enterprise Translation plugin <= 1.7.0 - Local File Inclusion via CSRF VulnerabilityJiro Sasamoto Ray Enterprise Translation
- CVE-2025-32490WordPress wp secure plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityWebsiteDefender wp secure
- CVE-2025-32504WordPress Silvasoft boekhouden plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilitySilvasoft boekhouden
- CVE-2025-32506WordPress AT Internet SmartTag plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityBenDlz AT Internet SmartTag
- CVE-2025-32507WordPress Event Espresso plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAakif Kadiwala Event Espresso – Custom Email Template Short…
- CVE-2025-32508WordPress Course Booking System plugin <= 6.1.2 - Reflected Cross Site Scripting (XSS) VulnerabilityComMotion Course Booking System
- CVE-2025-32511WordPress Make Email Customizer for WooCommerce plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityExcellent Dynamics Make Email Customizer for WooCommerce
- CVE-2025-32512WordPress Revamp CRM for WooCommerce plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityrevampcrm Revamp CRM for WooCommerce
- CVE-2025-32513WordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilitytotalprocessing Nomupay Payment Processing Gateway
- CVE-2025-32514WordPress WooCommerce Estimate and Quote plugin <= 1.0.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilitycscode WooCommerce Estimate and Quote
- CVE-2025-32515WordPress Terminal Africa plugin <= 1.13.24 - Cross Site Scripting (XSS) vulnerabilityterminalafrica Terminal Africa
- CVE-2025-32516WordPress Related Videos for JW Player plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityilGhera Related Videos for JW Player
- CVE-2025-32520WordPress WordPress Health and Server Condition plugin <= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityM. Ali Saleem WordPress Health and Server Condition – Integ…
- CVE-2025-32521WordPress Cool Flipbox plugin <= 1.8.3 - Reflected Cross Site Scripting (XSS) vulnerabilityCoolHappy Cool Flipbox – Shortcode & Gutenberg Block
- CVE-2025-32522WordPress License Manager for WooCommerce plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilitySaad Iqbal License Manager for WooCommerce
- CVE-2025-32526WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerabilityDylan James Zephyr Project Manager
- CVE-2025-32527WordPress T&P Gallery Slider plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilitypey22 T&P Gallery Slider
- CVE-2025-32528WordPress iCal Feeds Plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilitymaximevalette iCal Feeds
- CVE-2025-32529WordPress iONE360 configurator plugin <= 2.0.57 - Reflected Cross Site Scripting (XSS) vulnerabilityiONE360 configurator
- CVE-2025-32530WordPress Wallet System for WooCommerce plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Swings Wallet System for WooCommerce
- CVE-2025-32531WordPress Arconix FAQ plugin <= 1.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilitytychesoftwares Arconix FAQ
- CVE-2025-32532WordPress UXsniff plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityPei Yong Goh UXsniff
- CVE-2025-32533WordPress Deliver via Shipos for WooCommerce Plugin <= 2.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityMatat Technologies Deliver via Shipos for WooCommerce
- CVE-2025-32535WordPress DN Shipping by Weight for WooCommerce Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitydigireturn DN Shipping by Weight for WooCommerce
- CVE-2025-32540WordPress Feedify – Web Push Notifications plugin <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityFeedify – Web Push Notifications
- CVE-2025-32544WordPress WooCommerce Loyal Customers plugin <= 2.6 - Broken Access Control vulnerabilityThe Right Software WooCommerce Loyal Customers
- CVE-2025-32545WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilitySOFTAGON WooCommerce Products without featured images
- CVE-2025-32546WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilitygtlwpdev All push notification for WP
- CVE-2025-32548WordPress Hamburger Icon Menu Lite Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityborisolhor Hamburger Icon Menu Lite
- CVE-2025-32552WordPress MSRP (RRP) Pricing for WooCommerce Plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityWPFactory MSRP (RRP) Pricing for WooCommerce
- CVE-2025-32554WordPress Raptive Ads plugin <= 3.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityRaptive Ads
- CVE-2025-32557WordPress WP Featured Screenshot Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityRico Macchi WP Featured Screenshot
- CVE-2025-32560WordPress WP-Hijri Plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMohammad I. Okfie WP-Hijri
- CVE-2025-32561WordPress WP_DEBUG Toggle plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityplugins.club WP_DEBUG Toggle
- CVE-2025-32562WordPress WP Easy Poll Plugin <= 2.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityaviplugins.com WP Easy Poll
- CVE-2025-32564WordPress Stop Registration Spam Plugin <= 1.24 - Reflected Cross Site Scripting (XSS) vulnerabilitytomroyal Stop Registration Spam
- CVE-2025-32566WordPress License For Envato Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAshraful Sarkar Naiem License For Envato
- CVE-2025-32571WordPress TuriTop Booking System Plugin <= 1.0.10 - PHP Object Injection vulnerabilityTuriTop Booking System
- CVE-2025-32573WordPress KiotViet Sync Plugin <= 1.8.3 - SQL Injection vulnerabilityKiotViet Sync
- CVE-2025-32578WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityMapro Collins Coming Soon Countdown
- CVE-2025-32582WordPress WP AutoKeyword Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEXEIdeas International WP AutoKeyword
- CVE-2025-32588WordPress Credova_Financial plugin <= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityCredova Financial Credova_Financial
- CVE-2025-32590WordPress Web2application Plugin <= 6.1 - Reflected Cross Site Scripting (XSS) vulnerabilitytzin111 Web2application
- CVE-2025-32592WordPress TableOn Plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityRealMag777 TableOn
- CVE-2025-32593WordPress Add Product Frontend for WooCommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerabilityBytes Technolab Add Product Frontend for WooCommerce
- CVE-2025-32594WordPress Simple WP Events plugin <= 1.8.17 - Sensitive Data Exposure vulnerabilityWPMinds Simple WP Events
- CVE-2025-32596WordPress Real Estate Manager plugin <= 7.3 - Arbitrary Code Execution vulnerabilityRameez Iqbal Real Estate Manager
- CVE-2025-32602WordPress WooMS Plugin <= 9.12 - Reflected Cross Site Scripting (XSS) vulnerabilitywpcraft WooMS
- CVE-2025-32604WordPress AWSA Shipping Plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySajjad Aslani AWSA Shipping
- CVE-2025-32605WordPress MemberPress Discord Addon Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityexpresstechsoftware MemberPress Discord Addon
- CVE-2025-32606WordPress Listings for Buildium plugin <= 0.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityDeepak Khokhar Listings for Buildium
- CVE-2025-32608WordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerabilityMovylo Marketing Automation
- CVE-2025-32609WordPress Verowa Connect Plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityPicture-Planet Verowa Connect
- CVE-2025-32611WordPress WooCommerce TBC Credit Card Payment Gateway (Free) Plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityWe Are De WooCommerce TBC Credit Card Payment Gateway
- CVE-2025-32613WordPress Debug Log Manager plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityBowo Debug Log Manager
- CVE-2025-32615WordPress Clinked Client Portal Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerabilityClinked Client Portal
- CVE-2025-32620WordPress Doppler Forms plugin <= 2.4.6 - Broken Access Control vulnerabilityfromdoppler Doppler Forms
- CVE-2025-32622WordPress OTP-less one tap Sign in Plugin <= 2.0.58 - Reflected Cross Site Scripting (XSS) vulnerabilityOTP-less one tap Sign in
- CVE-2025-32625WordPress Mobile Blocks Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitypootlepress Mobile Pages
- CVE-2025-32628WordPress Crowdfunding for WooCommerce Plugin <= 3.1.12 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Wham Crowdfunding for WooCommerce
- CVE-2025-32630WordPress WP-BusinessDirectory Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCMSJunkie - WordPress Business Directory Plugins WP-Busines…
- CVE-2025-32634WordPress Run Contests, Raffles, and Giveaways plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitymdedev Run Contests, Raffles, and Giveaways with ContestsWP
- CVE-2025-32635WordPress Hive Support plugin <= 1.2.6 - Sensitive Data Exposure vulnerabilityHive Support
- CVE-2025-32637WordPress WP Donate Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityketanajani WP Donate
- CVE-2025-32638WordPress ShopApper plugin <= 0.4.61 - Cross Site Scripting (XSS) vulnerabilityweptile Mobile App for WooCommerce
- CVE-2025-32639WordPress Affiliate Links plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywecantrack Affiliate Links Lite
- CVE-2025-32646WordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerabilityPickPlugins Question Answer
- CVE-2025-32647WordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerabilityPickPlugins Question Answer
- CVE-2025-32649WordPress GB Gallery Slideshow Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitygb-plugins GB Gallery Slideshow
- CVE-2025-32651WordPress SERPed.net Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityserpednet SERPed.net
- CVE-2025-32653WordPress Cart66 Cloud Plugin <= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerabilityLee Blue Cart66 Cloud
- CVE-2025-32655WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityDevriX Restrict User Registration
- CVE-2025-32662WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerabilityStylemix uListing
- CVE-2025-32666WordPress Hive Support plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityHive Support
- CVE-2025-32670WordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityMark Parnell Spark GF Failed Submissions
- CVE-2025-32674WordPress Product Excel Import Export & Bulk Edit for WooCommerce plugin <= 4.7 - Cross Site Scripting (XSS) VulnerabilityWPFactory Product Excel Import Export & Bulk Edit for WooCo…
- CVE-2025-32686WordPress Team Members plugin <= 3.4.4 - PHP Object Injection VulnerabilityWPSpeedo Team Members
- CVE-2025-39519WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityrunthings.dev Bulk Page Stub Creator
- CVE-2025-39521WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityAshish Ajani Contact Form vCard Generator
- CVE-2025-39526WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerabilitynicdark Hotel Booking
- CVE-2025-39527WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerabilitybestweblayout Rating by BestWebSoft
- CVE-2025-39532WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerabilityspicethemes Spice Blocks
- CVE-2025-39533WordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerabilityStarfish Reviews Starfish Review Generation & Marketing
- CVE-2025-39535WordPress Vitepos plugin <= 3.1.7 - Broken Authentication Vulnerabilityappsbd Vitepos
- CVE-2025-39542WordPress Xelion Webchat plugin <= 9.1.0 - Privilege Escalation VulnerabilityJauhari Xelion Xelion Webchat
- CVE-2025-39558WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityCRM Perks
- CVE-2025-39567WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerabilityShamalli Web Directory Free
- CVE-2025-39568WordPress StoreContrl Woocommerce plugin <= 4.1.3 - Arbitrary File Download VulnerabilityArture B.V. StoreContrl Woocommerce
- CVE-2025-39569WordPress Taskbuilder plugin <= 4.0.1 - SQL Injection VulnerabilityTaskbuilder
- CVE-2025-39583WordPress BERTHA AI plugin <= 1.12.10.2 - Arbitrary Content Deletion VulnerabilityBertha AI – Andrew Palmer BERTHA AI
- CVE-2025-39586WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection VulnerabilityMetagauss ProfileGrid
- CVE-2025-39594WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityBob Arigato Autoresponder and Newsletter
- CVE-2024-12530Insecure Dynamic-Link Library (DLL) Load vulnerabilityOpenText Secure Content Manager
- CVE-2025-22565WordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityBill Zimmerman vooPlayer
- CVE-2025-22636WordPress VR-Frases plugin <= 4.0.1 - Reflected XSS to SQL Injection vulnerabilityVicente Ruiz Gálvez VR-Frases
- CVE-2025-22651WordPress Stylish Google Sheet Reader plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywppluginboxdev Stylish Google Sheet Reader
- CVE-2025-22692WordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityrachanaS Sponsered Link
- CVE-2025-22774WordPress CRUDLab Scroll to Top Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCRUDLab Scroll to Top
- CVE-2025-22796WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerabilityplatcom WP-Asambleas
- CVE-2025-26968WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerabilitywebbernaut Cloak Front End Email
- CVE-2025-39414WordPress spam-stopper plugin <= 3.1.3 - CSRF to Stored XSS vulnerabilityMike spam-stopper
- CVE-2025-39415WordPress Social Media Links plugin <= 1.0.3 - CSRF to Stored XSS vulnerabilityJayesh Parejiya Social Media Links
- CVE-2025-39416WordPress translit it! plugin <= 1.6 - CSRF to Stored XSS vulnerabilityIchi translit it!
- CVE-2025-39417WordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerabilityEslam Mahmoud Redirect wordpress to welcome or landing page
- CVE-2025-39418WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerabilityajayver RSS Manager
- CVE-2025-39419WordPress Revision Diet plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityDavid Miller Revision Diet
- CVE-2025-39420WordPress WP Twitter Button plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityruudkok WP Twitter Button
- CVE-2025-39421WordPress WP Sticky Side Buttons plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerabilityMustafa KUCUK WP Sticky Side Buttons
- CVE-2025-39422WordPress WP Social Bookmarking plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerabilityPResponsive WP Social Bookmarking
- CVE-2025-39423WordPress Add to Header plugin <= 1.0 - CSRF to XSS vulnerabilityJenst Add to Header
- CVE-2025-39424WordPress Simple Maps plugin <= 0.98 - CSRF to XSS vulnerabilitysimplemaps Simple Maps
- CVE-2025-39429WordPress Széchenyi 2020 Logo <= 1.1 - Local File Inclusion vulnerabilityFöldesi, Mihály Széchenyi 2020 Logo
- CVE-2025-39430WordPress mLanguage plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerabilityAlexander Rauscha mLanguage
- CVE-2025-39431WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerabilityAaron Forgue Amazon Showcase WordPress Plugin
- CVE-2025-39432WordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerabilityantonchanning bbPress2 shortcode whitelist
- CVE-2025-39433WordPress Bknewsticker plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerabilitybeke_ro Bknewsticker
- CVE-2025-39435WordPress My Marginalia plugin <= 1.0.6 - CSRF to Stored XSS vulnerabilitydavidfcarr My Marginalia
- CVE-2025-39440WordPress Broken Links Remover plugin <= 1.2.2 - CSRF to Stored XSS vulnerabilityRajesh Broken Links Remover
- CVE-2025-39441WordPress Dashboard Notepads plugin <= 1.2.1 - CSRF to Stored XSS vulnerabilityswedish boy Dashboard Notepads
- CVE-2025-39442WordPress Review Wave – Google Places Reviews plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerabilityMessageMetric Review Wave – Google Places Reviews
- CVE-2025-39452WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerabilityArraytics WPCafe
- CVE-2025-39455WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerabilityIP2Location Variables
- CVE-2025-39461WordPress Docket Cache plugin <= 24.07.02 - Local File Inclusion vulnerabilityNawawi Jamili Docket Cache
- CVE-2025-39462WordPress Smart Agreements plugin <= 1.0.3 - Local File Inclusion vulnerabilityteamzt Smart Agreements
- CVE-2025-39464WordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityrtowebsites AdminQuickbar
- CVE-2025-25234Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.Omnissa Unified Access Gateway
- CVE-2022-26323Incorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product.OpenText™ Operations Bridge Manager · OpenText™ Operatio… +1
- CVE-2025-1532Code Injection Vulnerability in Phoneservicecom.hihonor.phoneservice
- CVE-2025-2188Whitelist bypass Vulnerability in GameCentercom.hihonor.gamecenter
- CVE-2025-2903Privilege Chaining in DelphixPerforce Delphix
- CVE-2024-13925Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive LoggingKlarna Checkout for WooCommerce
- CVE-2025-3294WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Updatebenjaminprojas WP Editor
- CVE-2025-1290A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS.Google ChromeOS
- CVE-2024-55211An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.
- CVE-2024-55238OpenMetadata <=1.4.1 is vulnerable to SQL Injection.org.open-metadata:openmetadata-service
- CVE-2025-25454Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2.
- CVE-2025-25455Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2.
- CVE-2025-25457Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via cloneType2.
- CVE-2025-29039An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8
- CVE-2025-29180In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability.
- CVE-2025-29181FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
- CVE-2025-29451An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component.
- CVE-2025-29452An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component.
- CVE-2025-29457An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function.
- CVE-2025-29458An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function.
- CVE-2025-29459An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function.
- CVE-2025-29460An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function.
- CVE-2025-29461An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path.
- CVE-2025-29661Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run.
- CVE-2025-43715Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation,Nullsoft Scriptable Install System
Medium, low and unrated 75
- CVE-2025-3124Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository namesGitHub Enterprise Server
- CVE-2024-42178HCL MyXalytics is affected by a failure to restrict URL access vulnerabilityHCL Software HCL MyXalytics
- CVE-2025-3765SourceCodester Web-based Pharmacy Product Management System edit-photo.php unrestricted uploadSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3764SourceCodester Web-based Pharmacy Product Management System edit-product.php unrestricted uploadSourceCodester Web-based Pharmacy Product Management System
- CVE-2024-42177HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilitiesHCL Software HCL MyXalytics
- CVE-2025-3763SourceCodester Phone Management System Password main buffer overflowSourceCodester Phone Management System
- CVE-2025-3762PCMan FTP Server MPUT Command buffer overflowPCMan FTP Server
- CVE-2021-47671can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error pathLinux
- CVE-2020-36789can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ contextLinux
- CVE-2025-43014In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmationJetBrains Toolbox App
- CVE-2025-43013In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possibleJetBrains Toolbox App
- CVE-2025-42921In JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginJetBrains Toolbox App
- CVE-2025-23773WordPress Delete All Posts plugin <= 1.1.1 - Broken Access Control vulnerabilitymingocommerce Delete All Posts
- CVE-2025-23906WordPress WordPress Dashboard Tweeter plugin <= 1.3.2 - Settings Change vulnerabilitywpseek WordPress Dashboard Tweeter
- CVE-2025-23958WordPress Editor Wysiwyg Background Color plugin <= 1.0 - Broken Access Control vulnerabilityFADI MED Editor Wysiwyg Background Color
- CVE-2025-24550WordPress Job Manager plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityJobScore Job Manager
- CVE-2025-24577WordPress Poll Maker plugin <= 5.5.0 - Broken Access Control vulnerabilityAys Pro Poll Maker
- CVE-2025-24581WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerabilityThemefic Instantio
- CVE-2025-24583WordPress 12 Step Meeting List plugin <= 3.16.5 - Settings Change vulnerabilityAA Web Servant 12 Step Meeting List
- CVE-2025-24651WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2025-24737WordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerabilityMat Bao WP Helper Premium
- CVE-2025-27283WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Download vulnerabilityrockgod100 Theme File Duplicator
- CVE-2025-27299WordPress MyTicket Events plugin <= 1.2.4 - Non-Arbitrary File Read vulnerabilityWP Asia MyTicket Events
- CVE-2025-27310WordPress Page and Post Lister plugin <= 1.2.1 - Arbitrary Content Deletion vulnerabilityRadius of Thought Page and Post Lister
- CVE-2025-39554WordPress AI Text to Speech plugin <= 3.0.3 - Broken Access Control vulnerabilityElliot Sowersby / RelyWP AI Text to Speech
- CVE-2025-39559WordPress Bring Fraktguiden for WooCommerce plugin <= 1.11.4 - Broken Access Control vulnerabilityEivin Landa Bring Fraktguiden for WooCommerce
- CVE-2025-39562WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerabilitycodepeople Payment Form for PayPal Pro
- CVE-2025-39580WordPress Dashi plugin <= 3.1.8 - Broken Access Control Vulnerabilityjidaikobo Dashi
- CVE-2025-22340WordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityThink201 Data Dash
- CVE-2025-22771WordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityStudio Hyperset The Great Firewords of China
- CVE-2025-39425WordPress Style Manager plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilitypixelgrade Style Manager
- CVE-2025-39426WordPress illow – Cookies Consent plugin <= 0.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityillow – Cookies Consent
- CVE-2025-39427WordPress WP Post to PDF Enhanced plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityBeth Tucker Long WP Post to PDF Enhanced
- CVE-2025-39428WordPress Gravity Forms CSS Themes with Fontawesome and Placeholders plugin <= 8.5 - Cross Site Scripting (XSS) vulnerabilityMaros Pristas Gravity Forms CSS Themes with Fontawesome and…
- CVE-2025-39434WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerabilityScott Taylor Avatar
- CVE-2025-39437WordPress Anthologize plugin <= 0.8.3 - Cross Site Request Forgery (CSRF) vulnerabilityBoone Gorges Anthologize
- CVE-2025-39438WordPress Theme Changer plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilitymomen2009 Theme Changer
- CVE-2025-39439WordPress wpLike2Get plugin <= 1.2.9 - Sensitive Data Exposure vulnerabilityMarkus Drubba wpLike2Get
- CVE-2025-39444WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerabilitymaxfoundry MaxButtons
- CVE-2025-39443WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerabilitySoft8Soft Verge3D
- CVE-2025-39453WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.9.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityalgol.plus Advanced Dynamic Pricing for WooCommerce
- CVE-2025-39456WordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerabilityiTRON WP Logger
- CVE-2025-39457WordPress Booking and Rental Manager plugin <= 2.2.8 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-3760A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, andLiferay Portal · Liferay DXP +2
- CVE-2025-26477Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability.Dell ECS
- CVE-2025-26478Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability.Dell ECS
- CVE-2025-3479Forminator <= 1.42.0 - Order Replay Vulnerabilitywpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-3487Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'wpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-3453Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposuresaadiqbal Password Protected — Lock Entire Site, Pages, Pos…
- CVE-2025-29931A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2).Siemens TeleControl Server Basic
- CVE-2025-2197Type Confusion Vulnerability in Browsercom. hihonor.baidu.browser
- CVE-2025-3615Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2025-1525Ultimate Dashboard < 3.8.6 - Admin+ Stored XSSUltimate Dashboard
- CVE-2025-1524Ultimate Dashboard < 3.8.6 - Admin+ Stored XSSUltimate Dashboard
- CVE-2025-1523Ultimate Dashboard < 3.8.6 - Admin+ Stored XSSUltimate Dashboard
- CVE-2024-11924Email Subscribers < 5.7.52 - Admin+ Stored XSSIcegram Express formerly known as Email Subscribers
- CVE-2025-3295WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Readbenjaminprojas WP Editor
- CVE-2025-31338Wisdom Master Pro - Missing AuthorizationSUNNET Technology Co. Wisdom Master Pro
- CVE-2025-31339Wisdom Master Pro - Unrestricted Upload of File with Dangerous TypeSUNNET Technology Co. Wisdom Master Pro
- CVE-2024-40124Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.
- CVE-2025-26268DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command.DragonflyDB Dragonfly
- CVE-2025-26269DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua librDragonflyDB Dragonfly
- CVE-2025-28101An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles cr
- CVE-2025-29015Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.
- CVE-2025-29316An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive i
- CVE-2025-29449An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function.
- CVE-2025-29450An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component.
- CVE-2025-29453An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my
- CVE-2025-29454An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Up
- CVE-2025-29455An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Tr
- CVE-2025-29456An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the cr
- CVE-2025-29722A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users.
- CVE-2025-32415In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read.xmlsoft libxml2
- CVE-2025-43708VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowErrorVisiCut
- CVE-2025-43717In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postpavb HTTP_Request2 · pear/http_request2