Explore CVE records

MedPublished 23 Dec 2025, 18:43 WIB

CVE-2025-68557

WordPress Chakra test plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Vikas Ratudi Chakra test chakra-test allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chakra test: from n/a through <= 1.0.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 23 Dec 2025, 18:37 WIB

CVE-2025-68559

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.

Excerpt language: en.

HighPublished 23 Dec 2025, 18:36 WIB

CVE-2025-68560

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 23 Dec 2025, 18:34 WIB

CVE-2025-68561

WordPress AutomatorWP plugin <= 5.2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 23 Dec 2025, 18:31 WIB

CVE-2025-59886

Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Dec 2025, 21:43 WIB

Official record

MedPublished 23 Dec 2025, 18:13 WIB

CVE-2025-14635

Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:37 WIB

Official record

MedPublished 23 Dec 2025, 18:13 WIB

CVE-2025-14000

Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'register_form' and 'restrict' shortcodes in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:34 WIB

Official record

CritPublished 23 Dec 2025, 16:20 WIB

CVE-2025-14388

PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

HighPublished 23 Dec 2025, 16:20 WIB

CVE-2025-12934

Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'duplicate_wpml_layout' function in all versions up to, and including, 2.9.4.1. This makes it possible for authenticated attackers, with Subscriber-leve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:18 WIB

Official record

MedPublished 23 Dec 2025, 16:20 WIB

CVE-2025-14163

Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'

The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insert_inner_template' function. This makes it possible for unauthenticated attackers to create arbitrary Elementor templates v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:01 WIB

Official record

MedPublished 23 Dec 2025, 16:20 WIB

CVE-2025-14548

Calendar <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc'

The Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_desc' parameter in all versions up to, and including, 1.3.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

MedPublished 23 Dec 2025, 16:19 WIB

CVE-2025-14155

Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:36 WIB

Official record

MedPublished 23 Dec 2025, 07:32 WIB

CVE-2025-15034

itsourcecode Student Management System record.php sql injection

A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 22:37 WIB

Official record

MedPublished 23 Dec 2025, 07:01 WIB

CVE-2025-67743

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated23 Dec 2025, 22:41 WIB

Official record

UnscoredPublished 23 Dec 2025, 07:00 WIB

CVE-2024-57521

SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated24 Dec 2025, 02:13 WIB

Official record

UnscoredPublished 23 Dec 2025, 07:00 WIB

CVE-2025-25364

A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated24 Dec 2025, 01:37 WIB

Official record

UnscoredPublished 23 Dec 2025, 07:00 WIB

CVE-2025-29228

Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated24 Dec 2025, 02:05 WIB

Official record

UnscoredPublished 23 Dec 2025, 07:00 WIB

CVE-2025-29229

linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated23 Dec 2025, 23:40 WIB

Official record

UnscoredPublished 23 Dec 2025, 07:00 WIB

CVE-2025-45493

Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated23 Dec 2025, 23:54 WIB

Official record

UnscoredPublished 23 Dec 2025, 07:00 WIB

CVE-2025-50526

Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated23 Dec 2025, 23:50 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage