CVE-2025-7688 Add User Meta <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the 'add-user-meta' page. This makes it possible for unauthenticated attackers to update settings and inject...

PT-2025-33462 · WordPress · Add User Meta

Name of the Vulnerable Software and Affected Versions: Add User Meta plugin for WordPress versions up to and including 1.0.1 Description: The Add User Meta plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the add-user-meta page. Thi...

Linux Distros Unpatched Vulnerability : CVE-2022-49835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: hda: fix potential memleak in 'addwidgetnode' As 'kobjectadd' may allocated memory for 'kobject-name' when return error. And in this function, if call...

WordPress plugin Add User Meta 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Add User Meta plugin, which stems from missing or incorrect validation of random numbers on the "add-user-meta...

PHPGurukul Zoo Management System 跨站脚本漏洞

Zoo Management System is a zoo management system. Zoo Management System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the parameter visitorname in the file /admin/add-foreigner-ticket.php, which can be...

Linux Distros Unpatched Vulnerability : CVE-2024-42314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At addrabiopages we...

Malicious code in add-dictionary (npm)

The package add-dictionary was found to contain malicious code...

Malicious code in add-user (npm)

The package add-user was found to contain malicious code...

Malicious code in add-users (npm)

The package add-users was found to contain malicious code...

MAL-2025-14070 Malicious code in add-user (npm)

The package add-user was found to contain malicious code...

MAL-2025-14069 Malicious code in add-dictionary (npm)

The package add-dictionary was found to contain malicious code...

MAL-2025-14071 Malicious code in add-users (npm)

The package add-users was found to contain malicious code...

WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution Vulnerability

Arbitrary Code Execution Vulnerability discovered by Ryan Novotny in WordPress Plugin Add Custom Codes versions = 4.80...

ROS-20250814-07

A vulnerability in the libxml2 library is related to a post-release usage error in the function xmlXIncludeAddNode in xinclude.c. Exploitation of the vulnerability could allow an attacker acting remotely to compromise a vulnerable system...

The vulnerability of the atomic_add_return() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the atomicaddreturn function in the Linux operating system’s kernel is related to cyclic overflow. Exploiting this vulnerability can allow an attacker to trigger a service failure...

CVE-2025-55156

pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter addlinks in API /json/addpackage is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched ...

CVE-2025-45314

A cross-site scripting XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function...

Log Injection

pyload-ng is vulnerable to Log Injection. The vulnerability is due to improper input sanitization due to failure to filter user-supplied data in the /json/addpackage API, allowing attackers with package addition permissions to inject arbitrary messages into application logs...

kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in childcfsrqonlist childcfsrqonlist attempts to convert a 'prev' pointer to a cfsrq. This 'prev' pointer can originate from struct rq's leafcfsrqlist, making the conversion invalid and...

PT-2025-33061 · Unknown · Hortusfox-Web

Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A cross-site scripting XSS issue exists in the /Calendar endpoint of hortusfox-web version 4.4. Attackers can execute arbitrary JavaScript in a user's browser through a crafted payload injected into the...