AZL-60429 CVE-2025-32907 affecting package libsoup for versions less than 3.0.4-7

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a fu...

AZL-59530 CVE-2025-32052 affecting package libsoup for versions less than 3.0.4-6

A flaw was found in libsoup. A vulnerability in the sniffunknown function may lead to heap buffer over-read...

AZL-59539 CVE-2025-32049 affecting package libsoup for versions less than 3.0.4-12

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service DoS...

AZL-59551 CVE-2025-32050 affecting package libsoup for versions less than 3.0.4-6

A flaw was found in libsoup. The libsoup appendparamquoted function may contain an overflow bug resulting in a buffer under-read...

CVE-2025-30772

CVE-2025-30772 : A Missing Authorization vulnerability in the WordPress plugin “WPC Smart Upsell Funnel for WooCommerce”

CVE-2025-2685 TablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2025-2685 TablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

WordPress plugin WPC Smart Upsell Funnel for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-30588

Cross-Site Request Forgery CSRF vulnerability in ryanxantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through = 3.0.4...

WordPress Simple Banner plugin < 3.0.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Simple Banner versions 3.0.4...

CVE-2025-30588

Cross-Site Request Forgery CSRF vulnerability in ryanxantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through = 3.0.4...

CVE-2025-30588

CVE-2025-30588 — WordPress Map Contact: CSRF leads to Stored XSS in Map Contact plugin (affected:

CVE-2025-30588 WordPress Map Contact plugin <= 3.0.4 - CSRF to Stored XSS Vulnerability

Cross-Site Request Forgery CSRF vulnerability in ryanxantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through = 3.0.4...

WordPress Map Contact plugin <= 3.0.4 - CSRF to Stored XSS Vulnerability

CSRF to Stored XSS Vulnerability discovered by Abdi Pranata in WordPress Plugin Map Contact versions = 3.0.4...

AZL-61774 CVE-2025-30472 affecting package corosync 3.0.4-4

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet...

AZL-59189 CVE-2025-30472 affecting package corosync 3.0.4-3

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet...

CVE-2024-50631

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via...

PT-2025-10598 · Unknown · Information Kerala Mission Sanchaya

Name of the Vulnerable Software and Affected Versions: Information Kerala Mission SANCHAYA version 3.0.4 Description: The issue in the Property Tax Payment Portal of Information Kerala Mission SANCHAYA allows attackers to arbitrarily modify payment amounts via a crafted request. Recommendations:...

CVE-2025-27146 Matrix IRC Bridge allows IRC command injection to own puppeted user

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability h...

CVE-2025-27146 Matrix IRC Bridge allows IRC command injection to own puppeted user

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability h...