CVE index

CVE-2025-60218 affects WPLocker PT Luxa Addons. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-60205 affects ThemeREX ThemeREX Addons. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-60085 affects ThemeREX Group Learnify. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code

CVE-2025-59563 affects SONAAR MUSIC Sonaar. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-59560 affects SONAAR MUSIC Sonaar. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-58954 affects ThemeREX HomeRoofer. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-58953 affects ThemeREX Joly. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-58952 affects ThemeREX Neuronet. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2025-58924 affects ThemeREX Group Geya. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.

In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.