Critical SQL injection vulnerability in 1000 Projects ABC Courier Management System version 1.0, affecting the /admin endpoint's Username parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing real-world exploitation risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/EditCity.php endpoint. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability is likely being actively exploited in the wild.
Critical SQL injection vulnerability in PHPGurukul Local Services Search Engine Management System version 2.1, specifically in the /admin/edit-person-detail.php file where the 'editid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and may be actively exploited in the wild.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System 1.0, specifically in the /Admin/InsertCity.php file's cmbState parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.
A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0 affecting the /Admin/InsertCategory.php endpoint. An unauthenticated remote attacker can manipulate the txtCategoryName parameter to execute arbitrary SQL commands, potentially compromising database confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/NewsReport.php file where the 'txtFrom' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Critical SQL injection vulnerability in PHPGurukul Human Metapneumovirus Testing Management System 1.0, affecting the /registered-user-testing.php file via the 'testtype' parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database records without user interaction. The exploit has been publicly disclosed and is likely actively exploited in the wild, making this a high-priority security issue despite the moderate CVSS 7.3 score.
Critical SQL injection vulnerability in PHPGurukul Human Metapneumovirus Testing Management System version 1.0, affecting the /new-user-testing.php endpoint where the 'state' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. The vulnerability has public exploit code available and poses immediate risk to deployed instances.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/Property.php file where the 'cmbCat' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the property management database. The exploit has been publicly disclosed with proof-of-concept code available, significantly elevating real-world exploitation risk.
Critical SQL injection vulnerability in SourceCodester Open Source Clinic Management System v1.0, specifically in the /doctor.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of sensitive healthcare information. The vulnerability has public exploit disclosure and may be actively exploited.
A remote code execution vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in SourceCodester Open Source Clinic Management System 1.0 affecting the /appointment.php file's patient parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. The exploit has been publicly disclosed with proof-of-concept availability, significantly elevating real-world exploitation risk.
SourceCodester Open Source Clinic Management System version 1.0 contains a critical SQL injection vulnerability in the /email_config.php file affecting the 'email' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. Public disclosure and exploit code availability significantly elevate real-world risk.
CVE-2025-38002 is a security vulnerability (CVSS 5.5). Risk factors: public PoC available. Vendor patch is available.
WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of management cards. The issue results from the lack of personalization of management cards. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26292.
A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later
CVE-2025-48908 is a security vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures.
Authenticated file upload vulnerability in Agile Logix Store Locator WordPress plugin allows users with high privileges to upload a web shell to the server. The plugin versions through 1.5.2 are affected, and no public exploit or active exploitation has been identified at this time.
A remote code execution vulnerability (CVSS 6.6). Remediation should follow standard vulnerability management procedures.
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
The WP-Addpub plugin for WordPress is vulnerable to SQL Injection via the 'wp-addpub' shortcode in all versions up to, and including, 1.2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Stored cross-site scripting in SEPA Girocode WordPress plugin through 0.5.1 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages. The vulnerability is triggered when a user with contributor-level access or higher submits a crafted input that is stored and later executed in the context of another user's browser session. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in Bacon Ipsum WordPress plugin through version 2.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Simple Nested Menu WordPress plugin version 1.0 and earlier allows authenticated users with low privileges to inject scripts into menu items, which execute in the browser of victims viewing the affected content. No active exploitation, public exploit, or patch has been reported at this time, and EPSS predicts very low exploitation probability.
Stored cross-site scripting in Video Embeds WordPress plugin up to version 0.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into video embed pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the Abbie Expander WordPress plugin (≤1.0.1) enables authenticated attackers to inject JavaScript payloads into pages. When other users view the affected pages, the injected scripts execute, leading to data theft or unauthorized actions. The vulnerability has a low EPSS exploitation probability and is not known to be actively exploited.
Stored cross-site scripting in BRW WordPress plugin up to version 1.8.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in The Events Calendar Countdown Addon for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into event countdown displays. Affects versions up to 1.4.9. No public exploit or active exploitation identified.
Stored cross-site scripting in the Frontend Dashboard WordPress plugin (≤2.2.8) allows authenticated attackers with low privileges to inject malicious scripts into dashboard fields, which execute in the browsers of other users—including administrators—who view the affected content. Exploitation requires an attacker to have at least a Subscriber-level account and user interaction from a victim; no active exploitation or public exploit code is known.
Stored cross-site scripting in HT Team Member WordPress plugin up to version 1.1.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Product Catalog Simple WordPress plugin up to version 1.8.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into product catalog pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Search with Typesense WordPress plugin up to version 2.0.10 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-based cross-site scripting in the Greenshift WordPress plugin allows authenticated attackers with low privileges to execute arbitrary JavaScript in victims' browsers. The vulnerability affects all versions up to and including 11.5.5. No public exploit or active exploitation has been identified at this time, and the EPSS score of 0.05% indicates a low probability of widespread exploitation.
Stored cross-site scripting in WebHotelier WordPress plugin up to version 1.9.2 allows authenticated attackers with contributor-level access to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Event post WordPress plugin through version 5.10.1 allows authenticated attackers to inject arbitrary web scripts via unsanitized post fields, which execute when an administrator views the crafted content. This vulnerability carries a medium CVSS base score of 6.5, with low EPSS exploitation probability and no evidence of active exploitation. User interaction and authentication are required, limiting widespread impact.
Stored cross-site scripting (XSS) vulnerability in the Shortcodes Ultimate WordPress plugin versions up to 7.3.5 allows authenticated attackers to inject arbitrary web scripts that execute when an administrator or other user views a page containing the malicious shortcode. This could lead to session hijacking, credential theft, or site defacement. No active exploitation has been reported, and the EPSS score is very low (0.05%), indicating limited real-world risk.
Stored cross-site scripting in ShiftNav - Responsive Mobile Menu plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. The vulnerability affects all versions up to and including 1.8, and no public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in the Bellows Accordion Menu WordPress plugin allows authenticated attackers with contributor-level or higher permissions to inject malicious scripts into accordion items. When other users view the affected pages, the scripts execute in their browsers, potentially leading to session hijacking, account takeover, or content manipulation. No active exploitation or public exploit has been identified; the EPSS score of 0.05% indicates low exploitation probability.
Stored cross-site scripting (XSS) in RTMKit Addons for Elementor through version 1.6.0 allows authenticated attackers with contributor-level privileges to inject arbitrary JavaScript into pages. When an administrator views the compromised page, the script executes with their session, enabling data theft or further actions. No active exploitation or public proof-of-concept has been identified; EPSS score is low at 0.05%.
Stored cross-site scripting in Image Hover Effects Block for WordPress up to version 1.4.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in the Premium Packages plugin for WordPress allows authenticated attackers with low privileges to inject scripts that execute in other users' browsers when they view the malicious content. Versions up to 6.0.2 are affected, and no public exploit or active exploitation has been reported; EPSS estimates a 0.05% chance of exploitation.
Stored cross-site scripting in wpdive Nexa Blocks up to version 1.1.0 enables authenticated attackers with low privileges to inject malicious scripts into pages, leading to arbitrary script execution in the browsers of users who view the contaminated content. This can result in session hijacking, phishing, or site defacement. No active exploitation or public exploit has been identified; EPSS indicates low exploitation probability.
Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in All Currencies for WooCommerce plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.
Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).