Archive
February 2025
Vulnerabilities first published in this month (UTC), newest first.
1,716 results · Clear filters · Feed
-
Medium 6.5
WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.
-
Medium 6.5
WordPress WPGuppy plugin <= 1.1.0 - Broken Authentication vulnerability
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPGuppy: from n/a through <= 1.1.0.
-
Medium 6.5
WordPress Awesome Timeline plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XSS.This issue affects Awesome Timeline: from n/a through <= 1.0.1.
-
Medium 6.5
WordPress MLL Audio Player MP3 Ajax plugin <= 0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-audio-player allows Stored XSS.This issue affects MLL Audio Player MP3 Ajax: from n/a through <= 0.7.
-
Medium 6.5
WordPress Demo User DZS plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-your-admin-safely allows Stored XSS.This issue affects Demo User DZS: from n/a through <= 1.1.0.
-
Medium 6.5
WordPress WC Wallet plugin <= 2.2.0 - Arbitrary Content Deletion vulnerability
Missing Authorization vulnerability in hemnathmouli WC Wallet wc-wallet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WC Wallet: from n/a through <= 2.2.0.
-
Medium 4.0
Mali GPU Kernel Driver can cause the whole system to become unresponsive
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a non-privileged user process to make valid GPU memory proc…
-
Medium 6.8
Essential WP Real Estate <= 1.1.3 - Reflected XSS
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
-
Medium 5.3
In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote …
-
Medium 5.7
In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl…
-
Medium 6.2
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 6.2
In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl…
-
Medium 6.2
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 4.6
In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local informat…
-
Medium 6.2
In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.8
In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.7
In secmem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o…
-
Medium 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 5.0
MaxD Lightning Module deserialization
A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument li_op/md can lead to deserialization. The attack may be launched remotely. The attack requires …
-
Medium 5.4
CmsEasy index.php backAll_action path traversal
A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipula…
-
Medium 5.1
access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only…
-
Medium 6.5
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
-
Medium 6.1
itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in reg…
-
Medium 6.1
An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vul…
-
Medium 4.8CVE-2024-53942 EPSS 14%
An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vul…
-
Medium 6.5CVE-2024-36437 Public exploit
The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any inst…
-
Medium 4.8
ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.
-
Medium 5.4CVE-2024-57175 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0…
-
Medium 4.8
Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via th…
-
Medium 4.2
PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated…
-
Medium 6.3
Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get end…
-
Medium 6.4CVE-2024-57522 Public exploit
SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An a…
-
Medium 6.1CVE-2024-57004 EPSS 41%
Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malic…
-
Medium 5.0
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
-
Medium 6.1
Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive informa…
-
Medium 4.2
PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly addres…
-
Medium 5.3
Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the …
-
Medium 4.4
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently val…
-
Medium 4.4CVE-2025-25062 Public exploit
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isol…
-
Medium 5.3
SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.…