[SECURITY] [DLA 4296-1] qemu security update

Debian LTS Advisory DLA-4296-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón September 08, 2025 https://wiki.debian.org/LTS Package : qemu Version : 1:5.2+dfsg-11+deb11u5 CVE ID : CVE-2024-7409 Debian Bug : 1111844 Two security issues were discovered in...

CVE-2025-10123

A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub415028 of the file /goform/setstaticleases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-10123

D-Link DIR-823X routers up to firmware 250416 contain a command injection flaw in the sub_415028 function of /goform/set_static_leases, caused by insufficient input validation of the Hostname parameter. A remote unauthenticated attacker can execute arbitrary commands by sending a crafted request....

CVE-2025-10123 D-Link DIR-823X set_static_leases sub_415028 command injection

A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub415028 of the file /goform/setstaticleases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been...

WordPress plugin Export WP Page to Static HTML/CSS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2025-36801

Name of the Vulnerable Software and Affected Versions: Export WP Page to Static HTML/CSS versions n/a through 4.1.0 Description: A missing authorization issue exists in Export WP Page to Static HTML/CSS, allowing access to functionality not properly constrained by Access Control Lists ACLs...

CVE-2025-58980: Missing Authorization

Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through = 4.1.0...

CVE-2025-57072

Tenda G3 v3.0brV15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-57072

The Tenda G3 wireless access point (version v3.0br_V15.11.0.17 ) is susceptible to a stack-based buffer overflow vulnerability within the formSetStaticRoute function. The flaw specifically occurs during the processing of the staticRouteGateway parameter. A malicious actor can exploit this by send...

cosmicdbsemantic (>=0.0.24, <=0.0.29), django-markdown-messaging (0.0.1) +3 more potentially affected by CVE-2025-57833 via django (2.0.6)

django PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.24, =0.0.4, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2025-57833 Source advisory: OSV:GHSA-6W2R-R2M5-XQ5W...

appRain CMF SQL Injection Vulnerability (CNVD-2025-21133)

appRain CMF is a content management framework. appRain CMF suffers from an SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the data%5BPage%5D%5Bname%5D parameter of /apprain/page/manage-static-pages/create. An attacker could use this...

appRain CMF cross-site scripting vulnerability (CNVD-2025-21134)

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF due to improper validation of user input in the /apprain/page/manage-static-pages/create endpoint. An attacker could use this vulnerability to steal the victim's cookie-based authentication...

CVE-2025-41034

An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-static-pages/create/...

CVE-2025-41044

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...

CVE-2025-39713

In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in raininterrupt In the interrupt handler raininterrupt, the buffer full check on rain-buflen is performed before acquiring rain-buflock. This creates a Time-of-Check to Time-of-Us...

Malicious code in zero-static-scale-minify-encode (npm)

The package zero-static-scale-minify-encode was found to contain malicious code...

MAL-2025-46879 Malicious code in zero-static-scale-minify-encode (npm)

The package zero-static-scale-minify-encode was found to contain malicious code...

Path Traversal

org.springframework, spring-webmvc is vulnerable to Path Traversal Vulnerability. The vulnerability is due to improper URI path canonicalization in non-compliant Servlet containers when serving static resources, which allows an attacker to bypass security restrictions and access unauthorized file...

CVE-2025-41044

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...

CVE-2025-41044

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...