Vulnerabilities > Medium

DATE CVE VULNERABILITY TITLE RISK
2025-06-03 CVE-2025-5511 A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1.
network
low complexity
CWE-266
5.3
5.3
2025-06-03 CVE-2025-1334 IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be stored locally which can be read by another user on the system.
local
low complexity
CWE-525
4.0
4.0
2025-06-03 CVE-2025-25019 IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.
network
high complexity
CWE-613
4.8
4.8
2025-06-03 CVE-2025-25020 IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a denial of service due to improperly validating API data input.
network
low complexity
CWE-1287
6.5
6.5
2025-06-03 CVE-2025-5504 A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical.
network
low complexity
CWE-74
6.3
6.3
2025-06-03 CVE-2024-45655 IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
local
low complexity
CWE-732
5.5
5.5
2025-06-03 CVE-2025-5498 A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8.
network
low complexity
CWE-502
5.5
5.5
2025-06-03 CVE-2025-4205 The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping.
network
low complexity
CWE-79
6.4
6.4
2025-06-03 CVE-2025-4671 The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes.
network
low complexity
CWE-79
6.4
6.4
2025-06-03 CVE-2025-5340 The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping.
network
low complexity
CWE-79
6.4
6.4