NVD disclosure day
CVE-2022-50589
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability in SuiteCRM's export feature allows unauthenticated remote attackers to execute arbitrary code. This affects versions before 7.12.6 and is a critical issue because it can compromise system integrity and data confidentiality.
CVE-2025-60243
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An incorrect privilege assignment vulnerability in the Selling Commander for WooCommerce connector plugin allows for privilege escalation. If reachable, an unauthenticated attacker could potentially gain administrative control over a WordPress site, leading to a full compromise of the site and its data. This issue affe
CVE-2025-60235
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability exists in the WooCommerce Support Ticket System plugin, allowing the upload of malicious files. If reachable, this could lead to system compromise. Confirm if the plugin is in use and exposed to the internet.A critical vulnerability in the WooCommerce Support Ticket System plug
CVE-2025-60207
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in a WooCommerce user registration plugin allows uploading a web shell to a server. If reachable, this could enable unauthorized code execution and server control. Confirming if this plugin is deployed and internet-exposed is crucial for risk assessment.
CVE-2025-58998
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A deserialization vulnerability in s2Member allows for object injection, potentially enabling attackers to compromise affected systems when processing untrusted data. The issue is considered critical and externally reachable, meaning internet-facing systems could be at risk.
CVE-2025-58996
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An unrestricted file upload vulnerability in Helmut Wandl Advanced Settings allows an authenticated user to upload a web shell to a web server, potentially leading to unauthorized code execution. This could compromise server integrity and data if the affected component is reachable.
CVE-2025-58636
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical deserialization vulnerability in the WP Gravity Forms Keap/Infusionsoft plugin allows for object injection via untrusted data. If reachable, this could enable an attacker to execute arbitrary code, impacting system integrity and confidentiality. The plugin is integrated with Gravity Forms and Keap/Infusionso
CVE-2025-58627
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical authorization bypass vulnerability exists in the Miraculous Core Plugin, allowing unauthenticated users to exploit misconfigured access controls. This could lead to unauthorized access to sensitive data or system functions if the plugin is in use and reachable. Confirming usage and business criticality is ad