آخرین آسیب‌پذیری‌ها

Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR

PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import

FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard

FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR

SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings

Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action

Booking Package < 1.7.34 - Unauthenticated Payment Bypass

Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values

WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log

CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts

Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order

Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay

Command injection vulnerability

Improper access control vulnerability

Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redi…

A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.

Out-of-bounds Write in Bootloader

Improper Input Validation in Modem Firmware

Linksys E5600 Factory Quality Control fqc.cgi information disclosure

Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value…

Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write

Linksys E5600 Login mesh_login.cgi improper authentication