CVE Brief Security Intelligence

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows PHP Local File Inclusion

The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4

The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2

The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16

The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1

The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1

The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file

The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

SQL injection in Revive Adserver 6

Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection

Malicious or unintentional API requests can be used to add significant amount of data to caches

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection

The service Bizerba Communication Server (BCS) has an unquoted service path

ELOG allows an authenticated user to modify another user's profile

IBM i 7

When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted

On a client with an admin user, a Global_Shipping script can be implemented

By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part

ELOG allows an authenticated user to upload arbitrary HTML files

IBM InfoSphere Information Server 11

DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef

Scrapy versions up to 2

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have

Integer overflow in GameMaker IDE below 2024

Kitware VTK (Visualization Toolkit) up to 9

Totolink LR350 v9

Totolink LR350 v9

Totolink LR350 v9

Totolink LR350 v9

Summer Pearl Group Vacation Rental Management Platform prior to 1

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users

FutureNet MA and IP-K series provided by Century Systems Co

Kitware VTK (Visualization Toolkit) through 9

Agno is a multi-agent framework, runtime and control plane

ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service