CVE-2022-34641

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMP violation occurs during address translation...

WordPress plugin La Boom has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-31632: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in SpyroPress La Boom allows PHP Local File Inclusion. This issue affects La Boom: from n/a through 2.7...

PT-2025-22680 · Unknown · Spyropress La Boom

Name of the Vulnerable Software and Affected Versions: SpyroPress La Boom versions n/a through 2.7 Description: The issue affects SpyroPress La Boom, allowing PHP Local File Inclusion due to an Improper Control of Filename for Include/Require Statement in PHP Program. This is also known as a 'PHP...

CVE-2020-29561

An issue was discovered in SonicBOOM riscv-boom 3.0.0. For LR, it does not avoid acquiring a reservation in the case where a load translates successfully but still generates an exception...

WordPress La Boom theme <= 2.7 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme La Boom versions = 2.7...

WordPress La Boom Theme <= 2.7 is vulnerable to Local File Inclusion

Software La Boom Type Theme Vulnerable versions = 2.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-31632 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 52611de902eb Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2024-13673

The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13673 Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13673

CVE-2024-13673 affects the Big Boom Directory plugin for WordPress. It is a Stored XSS via the plugin's bbd-search shortcode in all versions up to 2.5.0, caused by insufficient input sanitization and output escaping. Authenticated users with contributor-level access can inject scripts that execut...

WordPress plugin Big Boom Directory has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-14586 · WordPress · Big Boom Directory

Name of the Vulnerable Software and Affected Versions: Big Boom Directory plugin for WordPress versions up to, and including, 2.5.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'bbd-search' shortcode. This allow...

CVE-2024-13673: Improper Neutralization of Input During Web Page Generation

The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress BoomBox Theme Extensions plugin <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password vulnerability

Authenticated Subscriber+ Privilege Escalation via Password Reset/Account Takeover in boomboxajaxresetpassword vulnerability discovered by Tonn in WordPress Plugin BoomBox Theme Extensions versions = 1.8.0...

boom-boot bug fix and enhancement update

An update is available for boom-boot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9....

WordPress Boom Fest plugin <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Settings Update vulnerability discovered by SOPROBRO in WordPress Plugin Boom Fest versions = 2.2.1...

CVE-2024-13449

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...

CVE-2024-13449

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...

CVE-2024-13449 Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...

CVE-2024-13449 Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...