Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.