Grootschalig misbruik van kritieke kwetsbaarheden in Craft CMS gemeld
Grootschalig misbruik van kritieke kwetsbaarheden in Craft CMS gemeld Aanvallers maken op grote schaal misbruik van kritieke kwetsbaarheden in Craft CMS, zo meldt CERT Orange Cyberdefense. Updates zijn inmiddels beschikbaar, maar websites zijn al voor het uitkomen van d … Read more Published Date: Apr 26, 2025 (4 hours, 9 minutes ago) Vulnerabilities has been mentioned in […]
CVE-2025-2101 – Edumall WordPress Local File Inclusion Vulnerability
The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the ‘template’ parameter of the ‘edumall_lazy_load_template’ AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. […]
CVE-2024-13812 – “Anps Theme Plugin WordPress Shortcode Injection Vulnerability”
The following table lists the changes that have been made to the CVE-2024-13812 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics. New CVE Received by [email protected] Apr. 26, 2025 Action […]
CVE-2025-2851 – GL.iNet RPC Handler Buffer Overflow
A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, […]
CVE-2025-2850 – “GL.iNet Router Unauthorized Download Interface Processing Vulnerability”
A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 […]
CVE-2025-2811 – “GL.iNet Router Regular Expression Complexity Inefficient Vulnerability”
A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 […]
CVE-2025-3914 – Airtable Aeropage Sync for WordPress Unauthenticated Arbitrary File Upload Vulnerability
The following table lists the changes that have been made to the CVE-2025-3914 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics. New CVE Received by [email protected] Apr. 26, 2025 Action […]
CVE-2025-3906 – Eduzz WooCommerce Unauthorized Data Modification Vulnerability
The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘wep_opcoes’ function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the default registration role within the plugin’s […]
CVE-2025-3491 – WordPress Add Custom Page Template PHP Code Injection
The following table lists the changes that have been made to the CVE-2025-3491 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics. New CVE Received by [email protected] Apr. 26, 2025 Action […]
CVE-2025-2907 – WordPress Order Delivery Date Plugin Authentication Bypass and CSRF Vulnerability
The following table lists the changes that have been made to the CVE-2025-2907 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics. New CVE Received by [email protected] Apr. 26, 2025 Action […]