CVE-2025-30576

CVE-2025-30576 (Hacklog Remote Image Autosave) is a CSRF vulnerability in Hacklog Remote Image Autosave affecting

WordPress Hacklog Remote Image Autosave plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Hacklog Remote Image Autosave versions = 2.1.0...

PT-2025-12621

Name of the Vulnerable Software and Affected Versions HuangYe WuDeng Hacklog Remote Image Autosave versions through 2.1.0 Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing...

WordPress plugin Hacklog Remote Image Autosave 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

CVE-2025-30576: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through = 2.1.0...

CVE-2024-2297

The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the createautosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above...

PT-2025-8915

Name of the Vulnerable Software and Affected Versions The Bricks theme for WordPress versions up to, and including, 1.9.6.1 Description The issue is due to insufficient validation checks on the create autosave AJAX function, allowing authenticated attackers with contributor-level access and above...

WordPress plugin Bricks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Bricksbuilder plugin <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave vulnerability

Authenticated Contributor+ Privilege Escalation via createautosave vulnerability discovered by etragardh in WordPress Theme Bricks Builder versions = 1.9.6.1...

Malicious code in sap-autosave (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a51a0bdf3fb114cb90f16633d8b64f1cc27d98a3b06b5e219700bc541a4bf461 The OpenSSF Package Analysis project identified 'sap-autosave' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7595 Malicious code in sap-autosave (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a51a0bdf3fb114cb90f16633d8b64f1cc27d98a3b06b5e219700bc541a4bf461 The OpenSSF Package Analysis project identified 'sap-autosave' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

GHSA-V626-R774-J7F8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes

Impact A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character...

TinyMCE -- mXSS in multiple plugins

TinyMCE reports: Special characters in unescaped text nodes can trigger mXSS when using TinyMCE undo/redo, getContentAPI, resetContentAPI, and Autosave plugin...

Cross-site Scripting (XSS)

TinyMCE is vulnerable to Cross-site Scripting XSS. The vulnerability occurs when an HTML snippet is restored from the undo stack. In this situation, a combination of string manipulation and reparative parsing by the browser's native DomParser API results in malicious mutations to the HTML. This, ...

CVE-2023-45818 Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

TinyMCE is an open source rich text editor. A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before...

GHSA-V65R-P3VV-JJFV TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin

Impact A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If t...

PT-2023-29707

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.10.8 TinyMCE versions prior to 6.7.1 Description A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS...

WordPress AutoSave Net Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software AutoSave Net Type Plugin Vulnerable versions = 1.3.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3520eb9add2b Credits Rafie Muhammad Patchstack Required...

SUSE CVE-2015-5332

Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service disk consumption by leveraging the guest role and entering drafts with the editor-autosave feature...

CVE-2022-36115

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for unintended functionality. An...