CVE-2025-2560
published 2025-05-19CVE-2025-2560: The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
PriorityP418medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.21%
11.7th percentile
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ninjaforms | ninja_forms | < 3.10.1 | 3.10.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET EXPLOIT ManageEngine Desktop Central Unauthorized Administrative Password Reset (CVE-2015-2560)
suricata·2025-07-08·CVSS 9.8
CVE-2015-2560 [CRITICAL] ET EXPLOIT ManageEngine Desktop Central Unauthorized Administrative Password Reset (CVE-2015-2560)
ET EXPLOIT ManageEngine Desktop Central Unauthorized Administrative Password Reset (CVE-2015-2560)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT ManageEngine Desktop Central Unauthorized Administrative Password Reset (CVE-2015-2560)"; flow:established,to_server; http.uri; content:"/DCOperationsServlet"; content:"operation=addOrModifyUser"; content:"roleId=DCAdmin"; fast_pattern; reference:cve,2015-2560; classtype:attempted-admin; sid:2063356; rev:1; metadata:affected_product Zoho_ManageEngine, attack_target Server, created_at 2025_07_08, cve CVE_2015_2560, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mit
No public exploits indexed.
No writeups or analysis indexed.
2025-05-19
Published