Skip to content
OpenAdvisories

Archive

9 June 2025

Vulnerabilities first published on this day (UTC), newest first.

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-49136 Public exploit

    listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. Whi…

  • Critical 9.3
    CVE-2025-47608 Public exploit

    WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce:…

  • Critical 9.8
    CVE-2025-48129 Public exploit

    WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet P…