Current: English
Posts tagged CVE.
GitLab has released emergency security updates to address a critical GraphQL code injection vulnerability that could allow unauthenticated attackers to modify or delete public projects and user data
Adobe has patched a critical command-injection vulnerability in Adobe Campaign Classic that carries the maximum CVSS score of 10.0 and can allow arbitrary code execution without authentication or user interaction
Winter CMS has addressed a high-severity stored cross-site scripting vulnerability affecting its backend branding functionality
CVE-2025-6254 affects the Doctreat Core WordPress plugin through version 1.6.8. The vulnerability allows unauthenticated attackers to register an account with administrator privileges because the registration handler does not properly restrict the requested role.
CVE-2026-5118 affects Divi Form Builder through version 5.1.2. The vulnerability allows unauthenticated attackers to create administrator accounts by manipulating the role value accepted during public form registration.
CVE-2026-8181 affects Burst Statistics – Privacy-Friendly WordPress Analytics versions 3.4.0 through 3.4.1.1. The vulnerability is an authentication bypass that can allow an unauthenticated attacker who knows an administrator username to impersonate that administrator during a request.
CVE-2026-3584 affects the Kali Forms WordPress plugin through version 2.4.9. The vulnerability allows unauthenticated remote code execution through the form_process functionality because attacker-controlled values can reach dynamic PHP callback execution.
CVE-2025-52078 affects the Writebot – AI Content Generator SaaS React Template through version 4.0.0. The vulnerability is an unauthenticated file-upload issue associated with the /file-upload endpoint.
CVE-2025-5394 affects the Alone – Charity Multipurpose Non-profit WordPress Theme through version 7.8.3. The theme exposes a plugin-installation function without sufficient capability checks, allowing unauthenticated attackers to upload and install plugin packages from remote locations.