CVEs

Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote Code Inclusion. This issue affects ACPT (Pro) - Custom Post Types Plugin for WordPress: from n/a through 2.0.47.

Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions.

Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.

Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions.

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.

Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attacker to write arbitrary files on the server.

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 versions.

Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerabili