Explore CVE records

CritPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31565

WordPress WPSmartContracts plugin <= 2.0.12 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through <= 2.0.12.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:07 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31379

WordPress Insert HTML Here plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here insert-html-here allows Reflected XSS.This issue affects Insert HTML Here: from n/a through <= 1.0.

Excerpt language: en.

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31378

WordPress Oppso Unit Converter plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter oppso-unit-converter allows Reflected XSS.This issue affects Oppso Unit Converter: from n/a through <= 1.1.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31041

WordPress AnyTrack Affiliate Link Manager plugin <= 1.0.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.0.4.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31040

WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through <= 2.7.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31028

WordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through <= 1.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31021

WordPress Mobile Smart plugin <= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dolby_uk Mobile Smart mobile-smart allows Reflected XSS.This issue affects Mobile Smart: from n/a through <= v1.3.16.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31015

WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk mailhawk allows PHP Local File Inclusion.This issue affects WordPress SMTP Service, Email Delivery Solved! — MailHawk: from n/a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:42 WIB

CVE-2025-31014

WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 11 Apr 2025, 15:21 WIB

CVE-2025-3434

SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs

The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:01 WIB

Official record

HighPublished 11 Apr 2025, 15:17 WIB

CVE-2025-32107

OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device.

Excerpt language: en.

CVSS8v3.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 20:54 WIB

Official record

MedPublished 11 Apr 2025, 14:39 WIB

CVE-2025-3512

Buffer overflow in QTextMarkdownImporter

There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Jul 2026, 14:29 WIB

Official record

MedPublished 11 Apr 2025, 11:27 WIB

CVE-2025-1386

Query smuggling in ch-go library

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.

Excerpt language: en.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:01 WIB

Official record

HighPublished 11 Apr 2025, 11:21 WIB

CVE-2025-2636

InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record

HighPublished 11 Apr 2025, 09:03 WIB

CVE-2025-0128

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to ente…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:01 WIB

Official record

HighPublished 11 Apr 2025, 09:01 WIB

CVE-2025-0127

PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed. Cloud NGFW and Pris…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:01 WIB

Official record

HighPublished 11 Apr 2025, 08:57 WIB

CVE-2025-0126

PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:02 WIB

Official record

MedPublished 11 Apr 2025, 08:56 WIB

CVE-2025-0125

PAN-OS: Improper Neutralization of Input in the Management Web Interface

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interfa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:02 WIB

Official record

MedPublished 11 Apr 2025, 08:55 WIB

CVE-2025-0124

PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:02 WIB

Official record

MedPublished 11 Apr 2025, 08:48 WIB

CVE-2025-0122

Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through Burst of Crafted Packets

A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.

Excerpt language: en.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:02 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage