Published threat advisories for August 28, 2025

A critical vulnerability in the Paymenter webshop solution allows authenticated users to upload arbitrary files via ticket attachments. This could lead to sensitive data extraction, credential exposure, and arbitrary system command execution, impacting the integrity and confidentiality of the webshop.

NVD modified: NVD date unavailable

A critical authentication bypass vulnerability exists in the NooTheme Jobmonster WordPress theme, potentially allowing unauthorized access to sensitive data and system functions. This issue arises from a flaw in the theme's authentication handling, which could be exploited by an unauthenticated attacker. It is importan

NVD modified: NVD date unavailable

A critical authentication bypass vulnerability in the uxper Golo theme could allow unauthorized access and abuse of authentication mechanisms. This issue impacts Golo through version 1.7.0. If reachable, an attacker could potentially gain unauthorized access to system functions. Confirmation of theme usage and version

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in a WordPress plugin, allowing an attacker to manipulate database queries over the network. If reachable, this could lead to unauthorized access to or modification of sensitive data. This issue warrants attention as it impacts data integrity and confidentiality.

NVD modified: NVD date unavailable

A critical deserialization vulnerability in the WP Funnel Manager plugin allows object injection, potentially leading to unauthorized system control or disruption. The issue is reachable externally, and its impact depends on whether the plugin is actively used and exposed.

NVD modified: NVD date unavailable

A critical privilege escalation vulnerability exists in the Miraculous Core Plugin. If reachable, this issue could allow unauthorized users to gain elevated privileges. Organizations using this plugin should determine its relevance and exposure to mitigate potential risks.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Drag and Drop File Upload for Elementor Forms plugin, enabling attackers to upload a web shell to a web server. This could lead to a complete compromise of affected websites. Because this plugin is often used on public-facing websites, the upload functionality is likely reachable

NVD modified: NVD date unavailable

A code injection vulnerability exists in the bidorbuy Store Integrator, potentially allowing remote code inclusion. If this tool is deployed and reachable, it could permit attackers with administrative access to execute arbitrary commands, impacting system integrity. Confirming its presence and exposure is necessary.

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in WooBeWoo Product Filter Pro, potentially allowing attackers to manipulate database queries and access sensitive information. This issue arises from improper handling of user input within SQL commands. Confirmation of the product's use and its internet accessibility is ne

NVD modified: NVD date unavailable

A critical vulnerability exists in SS1 and Media, allowing unauthenticated remote attackers to upload arbitrary files and execute OS commands with SYSTEM privileges. This threat is heightened as such systems are often network-exposed, potentially leading to system compromise. Identifying the presence and reachability o

NVD modified: NVD date unavailable

A critical vulnerability in SS1 allows unauthenticated remote attackers to upload arbitrary files and execute OS commands with SYSTEM privileges. This could lead to unauthorized system access and control if the technology is reachable over the network. Verifying the presence and exposure of SS1 within the environment i

NVD modified: NVD date unavailable