Tenable Agent for Windows Vulnerability Let Attackers Login as Admin to Delete The System Files

Tenable Agent for Windows Vulnerability Let Attackers Login as Admin to Delete The System Files

Tenable, a prominent cybersecurity provider, has released version 10.8.5 of its Agent software to address three critical security vulnerabilities affecting Windows hosts running versions prior to 10.8 …
Read more

Published Date:
Jun 14, 2025 (4 hours, 35 minutes ago)

Vulnerabilities has been mentioned in this article.

Read More

CVE-2025-4187 – UserPro – Community and User Profile WordPress Plugin Directory Traversal Vulnerability

CVE ID : CVE-2025-4187

Published : June 14, 2025, 9:15 a.m. | 4 hours, 56 minutes ago

Description : The UserPro – Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbconnect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Severity: 5.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-4592 – WordPress Free AI Image Generator CSRF Vulnerability

CVE ID : CVE-2025-4592

Published : June 14, 2025, 9:15 a.m. | 4 hours, 56 minutes ago

Description : The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the ‘wpz-ai-images’ page. This makes it possible for unauthenticated attackers to update the plugin’s API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-5589 – StreamWeasels Kick Integration for WordPress Stored Cross-Site Scripting

CVE ID : CVE-2025-5589

Published : June 14, 2025, 9:15 a.m. | 4 hours, 56 minutes ago

Description : The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘status-classic-offline-text’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More