Archive
9 October 2025
Vulnerabilities first published on this day (UTC), newest first.
170 results · Feed
-
Critical 9.8
Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user(…
-
Critical 9.9
Arbitrary Code Execution in Grafana Image Renderer Plugin
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to a…
-
Critical 9.8
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include …
-
Critical 9.8
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image function in all versions up to, and includi…
-
Medium 6.3
code-projects Online Complaint Site state.php sql injection
A weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation of the argument state causes sql injection. The attack is possible to be carried out remotely. The e…
-
High 8.8
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating …
-
High 7.8
Out-of-bounds Write in DSP Service
Memory corruption while invoking remote procedure IOCTL calls.
-
High 7.8
Use After Free in DSP Service
Memory corruption while allocating buffers in DSP service.
-
High 7.8
Integer Overflow or Wraparound in DSP Service
Memory corruption while processing user buffers.
-
High 7.8
Use of Out-of-range Pointer Offset in DSP Service
Memory corruption while processing an escape call.
-
High 7.8
Stack-based Buffer Overflow in Automotive Software platform based on QNX
Memory corruption while processing control commands in the virtual memory management interface.
-
High 7.1
Use After Free in BT Controller
Transient DOS may occur when multi-profile concurrency arises with QHS enabled.
-
High 7.8
Buffer Copy Without Checking Size of Input in Camera
memory corruption while processing an image encoding completion event.
-
High 7.8
Out-of-bounds Write in DSP Service
Memory corruption while processing IOCTL call to get the mapping.
-
High 7.8
Untrusted Pointer Dereference in DSP Service
Memory corruption while processing escape commands from userspace.
-
High 8.8
Untrusted Pointer Dereference in TZ Firmware
Memory corruption while performing SCM call with malformed inputs.
-
High 8.8
Use of Out-of-range Pointer Offset in TZ Firmware
Memory corruption while performing SCM call.
-
High 7.8
Out-of-bounds Write in Display
Memory corruption while processing a malformed license file during reboot.
-
High 7.8
Incorrect Calculation of Buffer Size in HLOS
Memory corruption during PlayReady APP usecase while processing TA commands.
-
Medium 5.5
Buffer Over-read in Camera
Transient DOS while processing IOCTL call for image encoding.
-
High 7.8
Untrusted Pointer Dereference in Camera
Memory corruption while processing camera platform driver IOCTL calls.
-
Medium 6.1
Buffer Over-read in Video
Information disclosure while processing batch command execution in Video driver.
-
Medium 5.5
Buffer Over-read in Video
Transient DOS while processing video packets received from video firmware.
-
Medium 6.5
Improper Input Validation in TZ Firmware
Information disclosure may occur while processing the hypervisor log.
-
Medium 6.6
Detection of Error Condition Without Action in Computer Vision
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
-
High 7.3
ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authentication
A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack …
-
High 8.8
Tenda AC7 saveAutoQos stack-based overflow
A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit…
-
High 8.8
Tenda AC7 fast_setting_pppoe_set stack-based overflow
A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing a manipulation of the argument Password can lead to stack-based buffer overflow. The attack may be launc…
-
High 8.8
Tenda AC7 WifiMacFilterSet stack-based overflow
A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing a manipulation of the argument wifi_chkHz results in stack-based buffer overflow. The attack may be initiated remo…
-
High 7.2
Cookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic…
-
Medium 5.4
WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper…
-
Critical 9.8
Community Events <= 1.5.1 - Unauthenticated SQL Injection
The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…
-
High 8.8
Tenda AC7 SetUpnpCfg stack-based overflow
A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been d…
-
High 8.8
Tenda AC7 SetDDNSCfg stack-based overflow
A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been …
-
Medium 6.3
Tenda AC7 AdvSetLanip command injection
A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is n…
-
Medium 6.3
code-projects Online Complaint Site complaint-details.php sql injection
A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack …
-
Medium 6.3
code-projects Online Complaint Site register-complaint.php sql injection
A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to i…
-
Medium 6.3
code-projects Online Complaint Site index.php sql injection
A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. Th…
-
Medium 6.1
Cross Site Scripting vulnerability in SVX Portal v.2.7A to execute arbitrary code via the TG parameter on last_heard_pa…
-
High 7.5
D-Link DIR-816A2_FWv1.10CNB05 was discovered to contain a stack overflow via the statuscheckpppoeuser parameter in the …