CVE-2025-69139
Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.
PUBLISHED
- Vendor
- AivahThemes
- Product
- Car Zone
- Provider severity
- HIGH
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2025-69138
Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.
PUBLISHED
- Vendor
- Jthemes
- Product
- Genemy
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69137
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
PUBLISHED
- Vendor
- Jthemes
- Product
- Genemy
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-69136
Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.
PUBLISHED
- Vendor
- THEMELOGI
- Product
- Wanium
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69135
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.
PUBLISHED
- Vendor
- CurlyThemes
- Product
- Events Schedule - WordPress Events Calendar Plugin
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69134
Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions.
PUBLISHED
- Vendor
- Merkulove
- Product
- OpenAI Chatbot for WordPress – Helper
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69133
Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
PUBLISHED
- Vendor
- GoodLayers
- Product
- Tourmaster
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69132
Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions.
PUBLISHED
- Vendor
- Zozothemes
- Product
- Corpkit
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-69131
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
PUBLISHED
- Vendor
- extendons
- Product
- WordPress & WooCommerce Scraper Plugin, Import Data from Any Site
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69130
Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.
PUBLISHED
- Vendor
- Themovation
- Product
- Entrepreneur - Booking for Small Businesses WordPress Theme
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-6913
A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- PHPGurukul
- Product
- Student Record System
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-69129
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
PUBLISHED
- Vendor
- Extendons
- Product
- WordPress & WooCommerce Scraper Plugin, Import Data from Any Site
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-69128
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3.
PUBLISHED
- Vendor
- EMV
- Product
- JobCareer
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69127
Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Plumbing
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-69126
Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Fortius
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69125
Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Food Drop
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69124
Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Especio
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69123
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Snow Club
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69122
Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- SeaFood Company
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-69121
Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Deliciosa
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69120
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Dazzle
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-6912
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been rated as critical. This issue affects some unknown processing of the file /manage-students.php. The manipulation of the argument del leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- PHPGurukul
- Product
- Student Record System
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-69119
Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Corbesier
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69118
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- CopyPress
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69117
Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Ingenioso
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69116
Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Iona
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69115
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- LuxMed | Medicine & Healthcare Doctor WordPress Theme
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69114
Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- MaxiNet
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69113
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Nexio
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69112
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Planty
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69111
Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Reisen
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-69110
Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- AirSupply
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-6911
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- PHPGurukul
- Product
- Student Record System
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-69109
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Raider Spirit
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69108
Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Hot Coffee
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-69107
Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Rosaleen
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69106
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Imba
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69105
Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
PUBLISHED
- Vendor
- ThemeREX
- Product
- Modernee
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69104
Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.
PUBLISHED
- Vendor
- jkdevstudio
- Product
- Qreatix
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69103
Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.
PUBLISHED
- Vendor
- Utillz
- Product
- Brikk
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69102
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through <= 1.1.7.
PUBLISHED
- Vendor
- Boopathi Rajan
- Product
- WP Test Email
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69101
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.
PUBLISHED
- Vendor
- AmentoTech
- Product
- Workreap Core
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-69100
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.This issue affects North: from n/a through <= 5.7.5.
PUBLISHED
- Vendor
- fuelthemes
- Product
- North
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-6910
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. The manipulation of the argument session leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- PHPGurukul
- Product
- Student Record System
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-69099
Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.
PUBLISHED
- Vendor
- fuelthemes
- Product
- North
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69098
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This issue affects Hide My WP: from n/a through <= 6.2.12.
PUBLISHED
- Vendor
- wpWave
- Product
- Hide My WP
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69097
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
PUBLISHED
- Vendor
- VibeThemes
- Product
- WPLMS
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69096
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zorka: from n/a through <= 1.5.7.
PUBLISHED
- Vendor
- G5Theme
- Product
- Zorka
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-69095
Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.
PUBLISHED
- Vendor
- designthemes
- Product
- Reservation Plugin
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-69094
Subscriber SQL Injection in Unicamp <= 2.2.2 versions.
PUBLISHED
- Vendor
- ThemeMove
- Product
- Unicamp
- Provider severity
- HIGH
- Conflicts
- 0