Explore CVE records

MedPublished 27 Jun 2025, 20:20 WIB

CVE-2025-53200

WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 6.7.3.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 27 Jun 2025, 20:20 WIB

CVE-2025-53199

WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through <= 1.6.5.

Excerpt language: en.

MedPublished 27 Jun 2025, 20:20 WIB

CVE-2025-53197

WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a through <= 4.5.8.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 27 Jun 2025, 20:20 WIB

CVE-2025-53193

WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics burst-statistics allows Cross Site Request Forgery.This issue affects Burst Statistics: from n/a through <= 2.0.6.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 27 Jun 2025, 20:00 WIB

CVE-2025-6767

sfturing hosp_order DoctorServiceImpl.java findDoctorByCondition sql injection

A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function findDoctorByCondition of the file DoctorServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. The attack may be initiated remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:36 WIB

Official record

LowPublished 27 Jun 2025, 20:00 WIB

CVE-2025-53018

Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS3v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:58 WIB

Official record

MedPublished 27 Jun 2025, 19:31 WIB

CVE-2025-6766

sfturing hosp_order OfficeServiceImpl.java getOfficeName sql injection

A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument officesName leads to sql injection. The attack can be initiated re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 19:58 WIB

Official record

UnscoredPublished 27 Jun 2025, 19:19 WIB

CVE-2025-40910

Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses

Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated08 Sep 2026, 01:26 WIB

Official record

MedPublished 27 Jun 2025, 19:00 WIB

CVE-2025-6765

Intelbras InControl HTTP PUT Request operador permission

A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:00 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-24765

WordPress Image Shadow plugin <= 1.1.0 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RobMarsh Image Shadow image-shadow allows Path Traversal.This issue affects Image Shadow: from n/a through <= 1.1.0.

Excerpt language: en.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-24769

WordPress Zenny theme <= 1.7.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Zenny bw-zenny allows PHP Local File Inclusion.This issue affects Zenny: from n/a through <= 1.7.5.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-24774

WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows Reflected XSS.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-25171

WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through <= 2.7.13.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-25173

WordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This issue affects FastBook: from n/a through <= 1.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-27361

WordPress Photo Express for Google plugin <= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thhake Photo Express for Google photo-express-for-google allows Reflected XSS.This issue affects Photo Express for Google: from n/a through <= 0.3.2.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-28946

WordPress PrintXtore theme < 1.7.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore bw-printxtore allows PHP Local File Inclusion.This issue affects PrintXtore: from n/a through < 1.7.8.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-28947

WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme MBStore - Digital WooCommerce WordPress Theme mbstore allows PHP Local File Inclusion.This issue affects MBStore - Digital WooCommerce WordPress Theme: from n/a through <= 2.3.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-28956

WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphobby Backwp backwp allows Reflected XSS.This issue affects Backwp: from n/a through <= 2.0.2.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Jun 2025, 18:52 WIB

CVE-2025-28960

WordPress Evangelische Termine plugin <= 3.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regibaer Evangelische Termine evangtermine allows Reflected XSS.This issue affects Evangelische Termine: from n/a through <= 3.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 27 Jun 2025, 18:52 WIB

CVE-2025-28970

WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimize By xTraffic: from n/a through <= 5.1.6.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage