8829 matches found
CVE-2025-10375: Cross-Site Request Forgery (CSRF)
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibesignup, accessibelogin, accessibelicensetrial, accessibemodifyconfig,...
EUVD-2025-33689
Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createinvoicesubmit.php”, using the “customerName0” parameter. This vulnerability could allow a...
PT-2025-41534
Name of the Vulnerable Software and Affected Versions Energy CRM version 2025 Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. A remote user can potentially send a malicious query to an authenticated user, potentially leading to the...
Energy CRM cross-site scripting vulnerability
Energy CRM is an enterprise resource management system from Energy UK. A cross-site scripting vulnerability exists in Energy CRM version v2025, which stems from insufficient input validation of the parameter customerName0 in the file /crm/createinvoicesubmit.php, which could lead to a stored...
CVE-2025-10249
The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above...
EUVD-2025-33332
The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above...
CVE-2025-10249 Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above...
PT-2025-41371
Name of the Vulnerable Software and Affected Versions Slider Revolution plugin for WordPress versions prior to 6.7.38 Description The Slider Revolution plugin for WordPress is susceptible to unauthorized access and modification of data because of a missing capability check on several functions...
CVE-2025-61928: Improper Authorization
Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the api/auth/api-key/create route. session?.user ?? authRequired ? null : i...
SUSE CVE-2022-50525
In the Linux kernel, the following vulnerability has been resolved: iommu/fslpamu: Fix resource leak in fslpamuprobe The fslpamuprobe returns directly when createcsd failed, leaving irq and memories unreleased. Fix by jumping to error if createcsd returns error...
CVE-2025-59303
HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress...
CVE-2025-10352: Missing Authorization
Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'...
Linux Distros Unpatched Vulnerability : CVE-2023-53528
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If createqp does not fully succeed it is possible...
CVE-2022-50525
In the Linux kernel, the following vulnerability has been resolved: iommu/fslpamu: Fix resource leak in fslpamuprobe The fslpamuprobe returns directly when createcsd failed, leaving irq and memories unreleased. Fix by jumping to error if createcsd returns error...
UBUNTU-CVE-2022-50525
In the Linux kernel, the following vulnerability has been resolved: iommu/fslpamu: Fix resource leak in fslpamuprobe The fslpamuprobe returns directly when createcsd failed, leaving irq and memories unreleased. Fix by jumping to error if createcsd returns error...
CVE-2022-50525 iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
In the Linux kernel, the following vulnerability has been resolved: iommu/fslpamu: Fix resource leak in fslpamuprobe The fslpamuprobe returns directly when createcsd failed, leaving irq and memories unreleased. Fix by jumping to error if createcsd returns error...
CVE-2022-50525
The CVE-2022-50525 issue affects the Linux kernel, specifically the iommu/fsl_pamu path. The root cause was in fsl_pamu_probe(): on create_csd() failure, the function returned early, leaving IRQs and memory unreleased. The patch fixes this by jumping to an error-handling path when create_csd() fa...
CVE-2022-50515
The connected SUSE/OSV entries confirm a concrete fix for CVE-2022-50515 in the Linux kernel’s DRM amdgpu path: memory leak in hpd_rx_irq_create_workqueue() when unwinding after failed workqueue construction. The SUSE-SU-2025:4320-1 advisory notes the SLES15 SP5 kernel update addresses this and o...
Malicious code in aes-create-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32024f762cae5f727853e7d6e07ee5012a1b440d859182a62be6123eb638e873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...