Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
A security vulnerability in MikoPBX (CVSS 9.9) that allows uploading a php script. Critical severity with potential for significant impact on affected systems.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the function SetDefaultConnectionService of the file /upnp/control/Layer3Forwarding of the component IGD. The manipulation of the argument NewDefaultConnectionService leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users."
CVE-2025-44557 is a security vulnerability (CVSS 8.1) that allows attackers. Risk factors: public PoC available.
A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to the NeacSafe64.sys component.
An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.
D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
Unauthenticated arbitrary file upload in HaruTheme's "Drag and Drop Multiple File Upload (Pro) - WooCommerce" WordPress plugin (all versions up to and including 5.0.6) lets remote attackers upload executable PHP files (a web shell) directly to the web server, yielding full remote code execution. The flaw carries a maximum CVSS 3.1 base score of 10.0 (scope-changed, network, no privileges, no user interaction), reported by Patchstack. EPSS is low at 0.19% and there is no public exploit identified at time of analysis, but the trivial exploitability and RCE outcome make this a high-priority patch.
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Remote code execution in CouponXxL WordPress theme up to version 3.0.0 allows unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, resulting in full site compromise. The vulnerability, reported via Patchstack, carries a CVSS 9.8 critical score but has no known in‑the‑wild exploitation or public exploit code at this time. EPSS probability is low (0.13%) but the ease of exploitation makes patching urgent.
Remote code execution in BoldThemes Amwerk theme for WordPress versions up to 1.2.0 allows unauthenticated attackers to inject malicious PHP objects via deserialization of untrusted data, leading to full site compromise. The vulnerability has a critical CVSS score but a low EPSS probability (0.13%), with no reported active exploitation or public proof-of-concept at this time.
Object injection via unsafe deserialization in the WP Optimize By xTraffic WordPress plugin allows unauthenticated remote attackers to achieve code execution by sending crafted serialized data. All plugin versions up to and including 5.1.6 are affected. No active exploitation or public exploit code has been identified, and EPSS predicts only a 0.13% chance of exploitation.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection.This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection.This issue affects Wowwo CRM. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection.This issue affects Case ERP: before V2.0.1.
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however this check is missing in versions prior to 2025.6.3 and 2025.4.3. When, for example, using RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser. authentik 2025.4.3 and 2025.6.3 fix this issue. As a workaround, it is recommended to decrease the duration a token is valid for (in the RAC Provider settings, set Connection expiry to `minutes=5` for example). The maintainers of authentik also recommend enabling the option Delete authorization on disconnect.
SQL injection via Cross-Site Request Forgery in the sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) lets a remote attacker who lures a logged-in privileged user into visiting a malicious page forge a state-changing request that reaches an unsanitized SQL query. Rated CVSS 9.6 with a scope change, it can compromise the WordPress database, but exploitation hinges on user interaction and there is no public exploit and a negligible EPSS of 0.03%.
Path traversal in the unauthenticated file upload endpoint of openvpn-cms-flask 1.2.7 and earlier allows remote attackers to write arbitrary files to the server, potentially achieving remote code execution. The vulnerability is publicly disclosed with a proof-of-concept, and a vendor patch is available in version 1.2.8.
Path traversal in DB-GPT versions 0.7.0 through 0.7.2 allows unauthenticated remote attackers to read or write files outside the intended directory by supplying crafted path sequences in the File argument of the AWEL flow import endpoint at /api/v2/serve/awel/flow/import. A proof-of-concept has been publicly disclosed via the eosphoros-ai GitHub issue tracker, materially lowering the bar for opportunistic exploitation against internet-exposed instances. No vendor-released patched version has been confirmed at time of analysis, leaving affected deployments without an official upstream fix.
SQL injection in code-projects Food Distributor Site 1.0 allows remote attackers to bypass authentication or extract sensitive data via crafted username/password inputs at /admin/process_login.php. A public proof-of-concept exploit is available, but no active exploitation has been confirmed. Despite being classified as "critical" by the reporter, the CVSS 4.0 base score is 5.5 (Medium) with low impact across confidentiality, integrity, and availability.
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.
SQL injection in ThemeMove Amely WordPress theme (≤3.1.4) allows unauthenticated remote attackers to extract sensitive database data via crafted SQL queries. The vulnerability is network-exploitable with no user interaction, presenting a severe risk to sites using the theme. No public exploit or active exploitation has been confirmed at this time.
2-3 sentence plain-language. Start with impact: SQL injection vulnerability in favethemes Homey theme for WordPress allows unauthenticated remote attackers to extract sensitive data from the database. Affects versions up to 2.4.5. No known active exploitation (no KEV, EPSS low), but POC not mentioned. The high CVSS is due to network vector and no auth, but scope change indicates impact may be limited to database if no further compromise. Just synthesize:
SQL injection in DirectIQ Email Marketing plugin ≤2.0 for WordPress allows unauthenticated remote attackers to extract sensitive data from the underlying database. The vulnerability carries a CVSS 9.3 critical rating due to its network attack vector, low complexity, and lack of required privileges or user interaction. No public exploit or active exploitation has been confirmed, and EPSS likelihood is very low (0.05%).
SQL injection in the Classiera WordPress classified-ads theme (all versions up to and including 4.0.34) lets remote attackers inject arbitrary SQL through an unauthenticated request path, per the Patchstack advisory that reported it. Because the CVSS vector specifies PR:N and a changed scope, an attacker can reach backend database content without credentials, exposing sensitive data across the WordPress installation. No public exploit has been identified and EPSS is very low (0.05%), indicating no observed weaponization at time of analysis.
SQL injection in GG Bought Together for WooCommerce plugin allows unauthenticated attackers to extract sensitive data from the WordPress database. Affects versions up to 1.0.2. The EPSS exploitation probability is very low (0.05%) and no public exploit or active exploitation has been identified, suggesting limited real-world risk despite the critical CVSS rating.
Remote code execution in the File Manager Plugin for WordPress versions up to 7.5 allows authenticated administrators to upload malicious PHP files via an unrestricted file upload flaw, leading to web shell deployment on the server. This vulnerability, reported by Patchstack, carries a CVSS 9.1 critical rating but has a low EPSS exploitation probability (0.09%) and no known active exploitation or public exploit code.
PHP object injection in the uxper Nuss WordPress theme through version 1.3.3 allows authenticated attackers with low privileges to execute arbitrary code or manipulate data via deserialization of untrusted input. Exploitation requires a valid WordPress account and the active theme; there is no evidence of active exploitation, and EPSS indicates low probability (0.16%).
Authenticated PHP object injection in the Sala WordPress theme (versions ≤1.1.3) enables remote code execution or data manipulation. Attackers with subscriber-level access can exploit insecure deserialization of untrusted data to inject arbitrary PHP objects. No active exploitation or public exploit code is currently known, and the EPSS score indicates low exploitation probability (0.16%).
Privilege escalation vulnerability in the MDJM Mobile DJ Manager WordPress plugin (versions ≤ 1.7.6) allows authenticated users to gain unauthorized access via missing authorization checks. A low-privilege attacker can exploit this to achieve full site compromise, with high impact on confidentiality, integrity, and availability. No active exploitation or public exploit code has been reported.
Account takeover via authentication bypass in WP SmartPay plugin versions up to 2.7.13 allows authenticated low-privileged users to gain full administrative control of the WordPress site. By exploiting an alternate authentication channel, attackers can escalate privileges, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is known; EPSS is low at 0.07%.
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
A security vulnerability in versions (CVSS 8.7) that allows attackers. High severity vulnerability requiring prompt remediation.
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
Arbitrary file deletion in the FW Food Menu WordPress plugin (≤6.0.0) allows remote attackers to delete server files, potentially causing service unavailability. Exploitation requires no authentication or user interaction, making it highly accessible. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.08%).
Privilege escalation in the CouponXxL Custom Post Types WordPress plugin (version ≤3.0) allows unauthenticated attackers to gain higher-level permissions due to incorrect privilege assignment. No active exploitation or public exploit code is known; EPSS predicts a 0.08 % probability of exploitation activity.
Remote, unauthenticated code injection in the Content No Cache WordPress plugin allows attackers to execute arbitrary PHP functions, leading to high confidentiality impact. This vulnerability, rated CVSS 8.6, affects all versions up to 0.1.3 and can be exploited without user interaction to disclose sensitive data such as configuration files. While exploitation is technically straightforward, EPSS data suggests a low probability of active exploitation in the wild.
A security vulnerability in BuddyPress Docs WordPress (CVSS 4.3) that allows a logged. Risk factors: public PoC available.