August 2025

1,498 results · Clear filters · Feed

• Medium 6.4
  CVE-2025-6228

  Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets

  The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Si…

  shaonsina Sina Extension for Elementor Web / CMS
  Aug 1, 2025
• Medium 6.4
  CVE-2025-4684

  BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets

  The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML a…

  blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Web / CMS
  Aug 1, 2025
• Medium 6.7
  CVE-2025-6398

  A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be …

  ASUS AI Suite
  Aug 1, 2025
• Medium 6.4
  CVE-2025-7646

  The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

  The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the …

  posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Web / CMS
  Aug 1, 2025
• Medium 5.8
  CVE-2025-5921

  SureForms < 1.7.2 - Reflected XSS

  The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.

  Web / CMS
  Aug 1, 2025
• Medium 5.1
  CVE-2025-31716

  In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…

  Unisoc (Shanghai) Technologies SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
  Aug 1, 2025
• Medium 6.4
  CVE-2025-7845

  Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets

  The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output esc…

  jetmonsters Stratum Widgets for Elementor Web / CMS
  Aug 1, 2025
• Medium 6.5
  CVE-2025-4523

  IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function

  The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible…

  themeatelier IDonate – Blood Donation, Request And Donor Management System Web / CMS
  Aug 1, 2025
• Medium 5.4
  CVE-2025-8433

  code-projects Document Management System dell.php unlink path traversal

  A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell.php. The manipulation of the argument ID leads to path traversal. The attack may be initiated remote…

  code-projects Document Management System
  Aug 1, 2025
• Medium 6.5
  CVE-2025-50868

  A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST par…

  Aug 1, 2025
• Medium 6.1
  CVE-2025-50869

  A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students …

  Aug 1, 2025
• Medium 6.9
  CVE-2025-53399

  In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core…

  Sipwise rtpengine rtpengine rtpengine Debian Ubuntu
  Aug 1, 2025
• Medium 5.4
  CVE-2025-46018 Public exploit

  CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authoriza…

  Aug 1, 2025
• Medium 6.1
  CVE-2025-45778 Public exploit

  A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execut…

  Aug 1, 2025
• Medium 6.1
  CVE-2025-51501 Scanner template

  Microweber has Reflected XSS Vulnerability in the id Parameter

  Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.

  microweber/microweber Packagist
  Aug 1, 2025
• Medium 6.1
  CVE-2025-51502 Scanner template

  Microweber has Reflected XSS Vulnerability in the layout Parameter

  Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.

  microweber/microweber Packagist
  Aug 1, 2025
• Medium 5.3
  CVE-2025-54939 Public exploit

  LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

  litespeedtech lsquic
  Aug 1, 2025
• Medium 5.8
  CVE-2019-19145

  Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 6…

  Quantum SuperLoader
  Aug 1, 2025