| 2025-04-24 | CVE-2025-1976 | Broadcom | OS Command Injection vulnerability in Broadcom Fabric Operating System Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6. | 6.7 |
| 2025-04-22 | CVE-2025-1732 | | An improper privilege management vulnerability in the recovery function of the USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device. | 6.7 |
| 2025-04-27 | CVE-2025-3979 | Lecms | Cross-Site Request Forgery (CSRF) vulnerability in Lecms 3.0.3 A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. | 6.5 |
| 2025-04-27 | CVE-2025-46576 | ZTE | Unspecified vulnerability in ZTE Zxcloud Goldendb 6.1.03.09/6.1.03.10/7.2.01.01 There is a Permission Management and Access Control vulnerability in the GoldenDB database product. | 6.5 |
| 2025-04-26 | CVE-2024-13812 | | The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. | 6.5 |
| 2025-04-25 | CVE-2025-3775 | | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. | 6.5 |
| 2025-04-24 | CVE-2025-3280 | | The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 6.5 |
| 2025-04-25 | CVE-2025-3752 | | The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-24 | CVE-2025-3749 | | The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-24 | CVE-2025-2543 | | The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-24 | CVE-2025-2579 | | The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-24 | CVE-2025-3832 | | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-23 | CVE-2025-1054 | | The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, UI Testimonial Slider, UI Testimonial Grid, and UI Testimonial Carousel widgets in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-22 | CVE-2025-2839 | | The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-22 | CVE-2025-3814 | | The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. | 6.4 |
| 2025-04-23 | CVE-2024-22351 | | IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. | 6.3 |
| 2025-04-22 | CVE-2025-3856 | | A vulnerability was found in xxyopen Novel-Plus 5.1.0. | 6.3 |
| 2025-04-21 | CVE-2025-3842 | | A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. | 6.3 |
| 2025-04-27 | CVE-2025-46689 | Ververica | Cross-site Scripting vulnerability in Ververica Platform 2.14.0 Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI. | 6.1 |
| 2025-04-27 | CVE-2025-46657 | Karaz | Cross-site Scripting vulnerability in Karaz Karazal Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI. | 6.1 |
| 2025-04-25 | CVE-2025-3870 | | The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. | 6.1 |
| 2025-04-25 | CVE-2025-3866 | | The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. | 6.1 |
| 2025-04-25 | CVE-2025-3867 | | The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. | 6.1 |
| 2025-04-25 | CVE-2025-3868 | | The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. | 6.1 |
| 2025-04-25 | CVE-2025-2986 | | IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. | 5.5 |
| 2025-04-27 | CVE-2025-3970 | Jsite | Cross-site Scripting vulnerability in Jsite A vulnerability classified as problematic has been found in baseweb JSite up to 1.0. | 5.4 |
| 2025-04-27 | CVE-2025-3965 | Itwanger | Cross-site Scripting vulnerability in Itwanger Paicoding 1.0.3 A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. | 5.4 |
| 2025-04-26 | CVE-2025-1458 | Bdthemes | Cross-site Scripting vulnerability in Bdthemes Element Pack The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. | 5.4 |
| 2025-04-25 | CVE-2025-3861 | | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on the 'pda_lite_custom_permission_check' function in versions 2.8.6 to 2.8.8.2. | 5.4 |
| 2025-04-22 | CVE-2025-3457 | Oceanwp | Cross-site Scripting vulnerability in Oceanwp Ocean Extra The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. | 5.4 |
| 2025-04-22 | CVE-2025-3458 | Oceanwp | Cross-site Scripting vulnerability in Oceanwp Ocean Extra The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. | 5.4 |
| 2025-04-22 | CVE-2025-46225 | Migaweb | Cross-site Scripting vulnerability in Migaweb Post in Page for Elementor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46226 | MPL Publisher | Cross-site Scripting vulnerability in Mpl-Publisher Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46227 | Brechtvds | Cross-site Scripting vulnerability in Brechtvds Custom Related Posts Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46228 | Avecnous | Cross-site Scripting vulnerability in Avecnous Event Post Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post allows DOM-Based XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46233 | Sirv | Cross-site Scripting vulnerability in Sirv Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46235 | Sktthemes | Cross-site Scripting vulnerability in Sktthemes SKT Blocks Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks – Gutenberg based Page Builder allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46236 | Ibericode | Cross-site Scripting vulnerability in Ibericode Html Forms Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46237 | Ylefebvre | Cross-site Scripting vulnerability in Ylefebvre Link Library Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46238 | Rolandbaer | Cross-site Scripting vulnerability in Rolandbaer List Last Changes Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46239 | Plugin Planet | Cross-site Scripting vulnerability in Plugin-Planet Theme Switcha Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46240 | Plugin Planet | Cross-site Scripting vulnerability in Plugin-Planet Simple Download Counter Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46253 | Wpmet | Cross-site Scripting vulnerability in Wpmet Gutenkit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit allows Stored XSS. | 5.4 |
| 2025-04-22 | CVE-2025-46254 | Visualcomposer | Cross-site Scripting vulnerability in Visualcomposer Visual Composer Website Builder Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. | 5.4 |
| 2025-04-27 | CVE-2025-3981 | Wowjoy | Missing Authorization vulnerability in Wowjoy Internet Doctor Workstation System 1.0 A vulnerability, which was classified as problematic, has been found in wowjoy ?????????????? Internet Doctor Workstation System 1.0. | 5.3 |
| 2025-04-27 | CVE-2025-3980 | Wowjoy | Missing Authorization vulnerability in Wowjoy Internet Doctor Workstation System 1.0 A vulnerability classified as problematic was found in wowjoy ?????????????? Internet Doctor Workstation System 1.0. | 5.3 |
| 2025-04-27 | CVE-2025-3966 | Itwanger | Unspecified vulnerability in Itwanger Paicoding 1.0.3 A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. | 5.3 |
| 2025-04-27 | CVE-2025-46574 | ZTE | Unspecified vulnerability in ZTE Zxcloud Goldendb 7.2.01.01 There is an information disclosure vulnerability in the GoldenDB database product. | 5.3 |
| 2025-04-25 | CVE-2025-3912 | | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_config' function in all versions up to, and including, 1.10.35. | 5.3 |
| 2025-04-25 | CVE-2025-3743 | | The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. | 5.3 |
| 2025-04-25 | CVE-2025-3923 | | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. | 5.3 |
| 2025-04-24 | CVE-2021-47664 | | Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames. | 5.3 |
| 2025-04-24 | CVE-2024-13307 | | The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_file', 'reales_delete_file_plans', 'reales_add_to_favourites', and 'reales_remove_from_favourites' functions in all versions up to, and including, 2.1.2. | 5.3 |
| 2025-04-23 | CVE-2025-2595 | | An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing. | 5.3 |
| 2025-04-21 | CVE-2025-43970 | Osrg | Improper Validation of Specified Quantity in Input vulnerability in Osrg Gobgp An issue was discovered in GoBGP before 3.35.0. | 5.3 |
| 2025-04-27 | CVE-2025-3984 | | A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. | 5.0 |
| 2025-04-25 | CVE-2025-2068 | | An open redirect vulnerability was reported in the FileZ client that could allow information disclosure if a crafted url is visited by a local user. | 5.0 |
| 2025-04-25 | CVE-2025-2069 | | A cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a local user. | 5.0 |
| 2025-04-25 | CVE-2025-2070 | | An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a local user. | 5.0 |
| 2025-04-25 | CVE-2025-2580 | | The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. | 4.9 |
| 2025-04-22 | CVE-2025-46242 | Kibokolabs | SQL Injection vulnerability in Kibokolabs Watu Quiz Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz allows SQL Injection. | 4.9 |
| 2025-04-22 | CVE-2025-46229 | Textmetrics | Cross-site Scripting vulnerability in Textmetrics Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics allows Stored XSS. | 4.8 |
| 2025-04-22 | CVE-2025-46250 | Vikasratudi | Cross-site Scripting vulnerability in Vikasratudi Lifetime Free Drag & Drop Contact Form Builder Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VForm allows Stored XSS. | 4.8 |
| 2025-04-23 | CVE-2025-46397 | | In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function. | 4.7 |
| 2025-04-23 | CVE-2025-46398 | | In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function. | 4.7 |
| 2025-04-23 | CVE-2025-46399 | | In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function. | 4.7 |
| 2025-04-23 | CVE-2025-46400 | | In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function. | 4.7 |
| 2025-04-22 | CVE-2025-31328 | | SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. | 4.6 |
| 2025-04-24 | CVE-2025-3435 | | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping. | 4.4 |
| 2025-04-27 | CVE-2025-3986 | | A vulnerability was found in Apereo CAS 5.2.6. | 4.3 |
| 2025-04-26 | CVE-2025-3915 | Aeropage | Missing Authorization vulnerability in Aeropage Sync for Airtable The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' function in all versions up to, and including, 3.2.0. | 4.3 |
| 2025-04-24 | CVE-2025-1284 | | The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX action due to missing validation on a user controlled key. | 4.3 |
| 2025-04-23 | CVE-2025-25045 | | IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. | 4.3 |
| 2025-04-22 | CVE-2025-31327 | | SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. | 4.3 |
| 2025-04-22 | CVE-2025-3855 | | A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. | 4.3 |
| 2025-04-22 | CVE-2025-3849 | | A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. | 4.3 |
| 2025-04-21 | CVE-2025-3843 | | A vulnerability was found in panhainan DS-Java 1.0. | 4.3 |
| 2025-04-27 | CVE-2025-46675 | Nasa | Improper Control of Dynamically-Managed Code Resources vulnerability in Nasa Cryptolib In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking. | 4.2 |
| 2025-04-24 | CVE-2025-3793 | | The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' function in all versions up to, and including, 0.1. | 4.2 |
| 2025-04-27 | CVE-2025-3961 | Withstars | Cross-site Scripting vulnerability in Withstars Books-Management-System 1.0 A vulnerability classified as problematic has been found in withstars Books-Management-System 1.0. | 4.1 |
| 2025-04-27 | CVE-2025-3962 | Withstars | Cross-site Scripting vulnerability in Withstars Books-Management-System 1.0 A vulnerability classified as problematic was found in withstars Books-Management-System 1.0. | 4.1 |
| 2025-04-27 | CVE-2025-3958 | Withstars | Cross-site Scripting vulnerability in Withstars Books-Management-System 1.0 A vulnerability was found in withstars Books-Management-System 1.0. | 4.1 |
| 2025-04-22 | CVE-2025-27907 | | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). | 4.1 |