CyberAlerts

CVE-2024-0797

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized...

Description: The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use.

CVSS: MEDIUM (4.3)

EPSS Score: 0.13%

SSVC Exploitation: none

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2024-0699

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file...

Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS: MEDIUM (6.6)

EPSS Score: 5.37%

SSVC Exploitation: none

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2025-4712

Campcodes Sales and Inventory System account_summary.php sql injection

Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/account_summary.php. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. In Campcodes Sales and Inventory System 1.0 wurde eine kritische Schwachstelle gefunden. Es geht um eine nicht näher bekannte Funktion der Datei /pages/account_summary.php. Durch das Beeinflussen des Arguments cid mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

CVSS: MEDIUM (6.9)

EPSS Score: 0.03%

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2025-30476

Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access...

Description: Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

CVSS: MEDIUM (5.3)

EPSS Score: 0.06%

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2024-56006

WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2024-51666

WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in Automattic Tours.This issue affects Tours: from n/a through 1.0.0.

CVSS: MEDIUM (4.3)

EPSS Score: 0.03%

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2025-47580

WordPress Front End Users plugin <= 3.2.32 - Sensitive Data Exposure vulnerability

Description: Missing Authorization vulnerability in Rustaurius Front End Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through 3.2.32.

CVSS: MEDIUM (5.4)

EPSS Score: 0.04%

Source: CVE

May 15th, 2025 (about 1 month ago)

CVE-2025-44110

FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.

Description: FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.

CVSS: MEDIUM (5.4)

EPSS Score: 0.03%

Source: CVE

May 15th, 2025 (about 1 month ago)

[bullfrogsec/bullfrog] Bullfrog's DNS over TCP bypasses domain filtering

Description: Summary Using tcp breaks blocking and allows DNS exfiltration. PoC name: test on: push: branches: - "*" jobs: testBullFrog: runs-on: ubuntu-22.04 steps: - name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status - name: Set up bullfrog to block everything uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2 with: egress-policy: block allowed-domains: | *.github.com - name: Test connectivity run: | echo testing udp allowed .. dig api.github.com @1.1.1.1 || : echo testing tcp allowed .. dig api.github.com @1.1.1.1 +tcp || : echo testing udp not allowed dig api.google.com @1.1.1.1 || : echo testing tcp not allowed dig api.google.com @1.1.1.1 +tcp || : Impact sandbox bypass References https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3 https://nvd.nist.gov/vuln/detail/CVE-2025-47775 https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4b3a6f8ffc2e49f501e30bf1a43d4671 https://github.com/bullfrogsec/bullfrog/releases/tag/v0.8.4 https://github.com/advisories/GHSA-m32f-fjw2-37v3

CVSS: MEDIUM (6.2)

EPSS Score: 0.02%

Source: Github Advisory Database (Actions)

May 15th, 2025 (about 1 month ago)

CVE-2025-4664

Google Chromium Loader Insufficient Policy Enforcement Vulnerability

Description: Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS: MEDIUM (4.3)

EPSS Score: 0.06%

Source: CISA KEV

May 15th, 2025 (about 1 month ago)

Threat and Vulnerability Intelligence Database

Example Searches: