CVE-2025-43865

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has bee...

CVE-2025-43865

CVE-2025-43865 affects React Router on the 7.0 branch before 7.5.2. The issue allows an attacker to modify pre-rendered data by adding a header to the request, enabling complete spoofing of the data object passed to the HTML. The vulnerability is patched in version 7.5.2. IBM’s bulletin notes thi...

CVE-2025-43865 React Router allows pre-render data spoofing on React-Router framework mode

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has bee...

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

PT-2025-17867

Name of the Vulnerable Software and Affected Versions React Router versions 7.2.0 through 7.5.2 Description The issue allows an attacker to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an erro...

CVE-2025-30964

Server-Side Request Forgery SSRF vulnerability in ThemeGoods Photography photography allows Server Side Request Forgery.This issue affects Photography: from n/a through 7.7.6...

CVE-2025-30168

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse...

CVE-2025-22702

Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photography: from n/a through = 7.7.2...

CVE-2025-22702

Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photography: from n/a through = 7.7.2...

CVE-2025-22702

CVE-2025-22702 concerns WordPress Photo­graphy theme (Photography) with versions ≤ 7.5.2. The issue is a Missing/ Missing Authorization vulnerability (broken access control) that could allow unauthorized access to resources. Public documentation in connected sources identifies the affected produc...

PT-2025-6963 · Unknown · Epc Photography

Name of the Vulnerable Software and Affected Versions: EPC Photography versions n/a through 7.5.2 Description: The issue is related to a Missing Authorization vulnerability in EPC Photography. This vulnerability affects the Photography component, allowing unauthorized access. The estimated number...

RHSA-2022:1462 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 7

Bulletin has no description...

RHSA-2022:1711 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 7

Bulletin has no description...

WordPress plugin SEOPress – On-site SEO 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress LifterLMS Plugin <= 7.5.1 is vulnerable to Broken Access Control

Software LifterLMS Type Plugin Vulnerable versions = 7.5.1 Fixed in 7.5.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0377 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 017a17d1f987 Credits Francesco Carlucci Required privileg...

Code injection

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

node-semver 安全漏洞

npm node-semver is a library from the American company npm. A security vulnerability exists in node-semver versions prior to 7.5.2, which stems from vulnerability to Regular Expression Denial of Service ReDoS attacks...

Vulnerabilities fixed in Mattermost

Unspecified vulnerabilities have been fixed in MatterMost. Mattermost has not released any substantive information released, but estimates the severity of the vulnerabilities as MEDIUM. The grading of this security advisory is accordingly accordingly. MatterMost indicates in accordance with their...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update

A security update is now available for Red Hat Single Sign-On 7.5 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...