The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete accounts of other users including admins.
[POC] CVE-2025-65856 — XM_ONVIF_auth_bypass
Proof-of-concept code (Bash and Python) for CVE-2025-65856 where ONVIF implementation in in Xiongmai XM530 IP cameras allows for unauthenticated access to sensitive device information and live video streams
[POC] CVE-2025-65856 — CVE-2025-65856
Xiongmai XM530 IP Camera ONVIF Complete Authentication Bypass
[POC] CVE-2025-65857 — CVE-2025-65857
Xiongmai XM530 IP Camera Hardcoded RTSP Credentials Exposure
[POC] CVE-2025-65855 — CVE-2025-65855
Security advisory for CVE-2025-65855
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free