A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the function SetDefaultConnectionService of the file /upnp/control/Layer3Forwarding of the component IGD. The manipulation of the argument NewDefaultConnectionService leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users."
CVE-2025-44557 is a security vulnerability (CVSS 8.1) that allows attackers. Risk factors: public PoC available.
A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.
PHP object injection in the uxper Nuss WordPress theme through version 1.3.3 allows authenticated attackers with low privileges to execute arbitrary code or manipulate data via deserialization of untrusted input. Exploitation requires a valid WordPress account and the active theme; there is no evidence of active exploitation, and EPSS indicates low probability (0.16%).
Authenticated PHP object injection in the Sala WordPress theme (versions ≤1.1.3) enables remote code execution or data manipulation. Attackers with subscriber-level access can exploit insecure deserialization of untrusted data to inject arbitrary PHP objects. No active exploitation or public exploit code is currently known, and the EPSS score indicates low exploitation probability (0.16%).
Privilege escalation vulnerability in the MDJM Mobile DJ Manager WordPress plugin (versions ≤ 1.7.6) allows authenticated users to gain unauthorized access via missing authorization checks. A low-privilege attacker can exploit this to achieve full site compromise, with high impact on confidentiality, integrity, and availability. No active exploitation or public exploit code has been reported.
Account takeover via authentication bypass in WP SmartPay plugin versions up to 2.7.13 allows authenticated low-privileged users to gain full administrative control of the WordPress site. By exploiting an alternate authentication channel, attackers can escalate privileges, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is known; EPSS is low at 0.07%.
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
A security vulnerability in versions (CVSS 8.7) that allows attackers. High severity vulnerability requiring prompt remediation.
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
Arbitrary file deletion in the FW Food Menu WordPress plugin (≤6.0.0) allows remote attackers to delete server files, potentially causing service unavailability. Exploitation requires no authentication or user interaction, making it highly accessible. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.08%).
Privilege escalation in the CouponXxL Custom Post Types WordPress plugin (version ≤3.0) allows unauthenticated attackers to gain higher-level permissions due to incorrect privilege assignment. No active exploitation or public exploit code is known; EPSS predicts a 0.08 % probability of exploitation activity.
Remote, unauthenticated code injection in the Content No Cache WordPress plugin allows attackers to execute arbitrary PHP functions, leading to high confidentiality impact. This vulnerability, rated CVSS 8.6, affects all versions up to 0.1.3 and can be exploited without user interaction to disclose sensitive data such as configuration files. While exploitation is technically straightforward, EPSS data suggests a low probability of active exploitation in the wild.
Unauthenticated missing authorization in the Abandoned Contact Form 7 WordPress plugin allows remote attackers to modify plugin data and cause a denial of service. The flaw affects versions up to 2.0 and stems from incorrectly configured access control levels, enabling any unauthenticated user to perform actions that should be restricted. The exploitation probability is low (EPSS 0.08%), and no active exploitation has been confirmed.
Unauthorized access to restricted whistleblowing data in the Trusty Whistleblowing WordPress plugin (≤1.5.2) allows remote, unauthenticated attackers to retrieve confidential reports via a missing authorization check. The vulnerability has no reported active exploitation or public exploit, but carries a CVSS score of 8.2 due to high confidentiality impact and low attack complexity. EPSS data indicates a 0.06% probability of exploitation in the wild, suggesting low immediate risk.
PHP local file inclusion
Local file inclusion in AncoraThemes CityGov WordPress theme through version 1.9 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure or code execution. Attack complexity is high, and no active exploitation has been confirmed; EPSS indicates a low likelihood of widespread exploitation.
A security vulnerability in ovatheme BRW allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in ApusWP Domnoo WordPress theme up to version 1.49 allows unauthenticated remote attackers to read arbitrary server files, potentially exposing credentials and leading to full site compromise. Exploitation requires high attack complexity and no user interaction. There is no public exploit or active exploitation confirmed at this time.
Local File Inclusion in the National Weather Service Alerts WordPress plugin through version 1.3.5 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing sensitive configuration data or enabling further attacks like remote code execution via log poisoning. No public exploit or active exploitation has been reported, and EPSS indicates a low probability of exploitation (0.16%).
A security vulnerability in thembay Diza allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in codesupplyco Networker allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in thembay Greenmart allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in the FW Gallery WordPress plugin (versions up to 8.0.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data like configuration files. The high attack complexity suggests exploitation depends on specific server conditions, not default configurations. No public exploit or active exploitation has been confirmed at time of analysis.
A security vulnerability in thembay Puca allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in the SERPed.net WordPress plugin (versions ≤4.6) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. No patch is available, and the plugin may be closed or abandoned. Exploitation risk is tempered by high attack complexity and a low EPSS score (0.16%), though successful exploitation yields full confidentiality, integrity, and availability impact.
A security vulnerability in snstheme SNS Vicky allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A remote code execution vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore allows PHP Local File Inclusion.
Unauthenticated Local File Inclusion in Zenny WordPress theme (up to version 1.7.5) allows remote attackers to include arbitrary local files, potentially achieving remote code execution and full server compromise. No known active exploitation or public exploit code is available at this time, and the EPSS score of 0.16% indicates a low probability of widespread attacks.
A security vulnerability in goalthemes Sofass allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.6.
A security vulnerability in real-web RealtyElite allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local File Inclusion in Zikzag Core WordPress plugin through version 1.4.5 allows unauthenticated attackers to include arbitrary local files, potentially leading to information disclosure or remote code execution. The vulnerability carries a CVSS score of 8.1 with high attack complexity, and no known public exploit or active exploitation has been identified at this time.
Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands, prior to version 3.20.3, it would have been possible for an attacker with access to craft a prompt to ask the agent to write a malicious command to the MCP configuration file. If the user had opted-in to auto-approving file writes within the project, this would have led to arbitrary command execution. This issue is of moderate severity, since it requires the attacker to already be able to submit prompts to the agent (for instance through a prompt injection attack), for the user to have MCP enabled (on by default), and for the user to have enabled auto-approved file writes (off by default). Version 3.20.3 fixes the issue by adding an additional layer of opt-in configuration for auto-approving writing to Roo's configuration files, including all files within the `.roo/` folder.
PHP Local File Inclusion in the Davenport WordPress theme versions up to 1.3 permits unauthenticated attackers to execute arbitrary code via a path traversal flaw, enabling full server compromise. The vulnerability has a CVSS 8.1 with high attack complexity and a low EPSS score of 0.06%, indicating reduced real-world exploitation probability. No active exploitation or public exploit has been identified at this time.
Remote path traversal in Katerio Magazine 1.5.1 and below allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to remote code execution. The vulnerability is rated 8.1 CVSS, but real-world exploitation probability is low (EPSS 0.06%), and no active exploitation or public exploit code has been identified.
Authenticated path traversal in the WordPress Image Shadow plugin up to version 1.1.0 allows low-privileged users to delete arbitrary files on the server, leading to a high availability impact. The vulnerability requires an authenticated attacker with minimal privileges and can be exploited over the network with low complexity. No active exploitation or public exploit code is known at this time, reflected by a very low EPSS score of 0.08%.
Authenticated SQL injection exists in the WP Forum Server WordPress plugin up to version 1.8.2, enabling high-privileged attackers (administrators) to read arbitrary data from the database. Exploitation requires administrative access and results in high confidentiality impact; no active exploitation or public exploit is known, and EPSS indicates a very low probability of widespread use.
Authenticated SQL injection in the Wow-Company Hover Effects plugin for WordPress up to version 2.1.2 allows high-privilege attackers to extract sensitive information from the website database. The vulnerability requires administrative access to the plugin interface, but successful exploitation can fully compromise data confidentiality. No active exploitation or public exploit code has been identified at the time of analysis.
High-privilege SQL injection in the YaySMTP WordPress plugin (versions through 2.6.5) allows authenticated administrators to extract sensitive database information via network requests. No active exploitation or public exploit code has been identified, and EPSS predicts a low 0.05% chance of exploitation in the near term.
During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which may include sensitive information such as network credentials.
A security vulnerability in devnex Devnex Addons For Elementor allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Local file inclusion in WPB Category Slider for WooCommerce 1.71 and earlier allows authenticated low-privilege users (e.g., subscribers) to include arbitrary local files on the WordPress host, potentially leading to sensitive data disclosure or remote code execution. No evidence of active exploitation or public exploit code exists; the EPSS score of 0.16% (36th percentile) indicates a low probability of widespread attacks.
A security vulnerability in nicdark Hotel Booking allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Local File Inclusion in the Gmedia Photo Gallery WordPress plugin (≤1.23.0) allows low-privileged authenticated attackers to include arbitrary local files on the server, potentially leading to sensitive data exposure or code execution. No active exploitation has been reported, and the EPSS exploitation probability is low (0.16%).
Local file inclusion in CTUsers WordPress plugin up to 1.0.0 allows unauthenticated attackers to include arbitrary local files via a crafted request. Exploitation requires user interaction and high attack complexity, but can lead to full compromise of the affected server, including disclosure of sensitive data or code execution. The vulnerability is not known to be actively exploited and has a low EPSS probability score.
An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint /ISAPI/Security/challenge. The vendor has stated that upgrading to V5.7.23_SP2 fixes the issue.