CVE-2025-58914

Cross-Site Request Forgery CSRF vulnerability in Di Themes Di Themes Demo Site Importer di-themes-demo-site-importer allows Cross Site Request Forgery.This issue affects Di Themes Demo Site Importer: from n/a through = 1.2...

CVE-2025-58914 WordPress Di Themes Demo Site Importer plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Plugin Activation vulnerability

Cross-Site Request Forgery CSRF vulnerability in Di Themes Di Themes Demo Site Importer allows Cross Site Request Forgery. This issue affects Di Themes Demo Site Importer: from n/a through 1.2...

CVE-2025-58914

CVE-2025-58914 describes a CSRF vulnerability in the WordPress plugin Di Themes Demo Site Importer , affecting versions up to 1.2 (the range includes from n/a to 1.2). The Connected documents confirm the vulnerability type (CSRF) and the affected software, but do not provide concrete remediation ...

CVE-2025-58914: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Di Themes Di Themes Demo Site Importer di-themes-demo-site-importer allows Cross Site Request Forgery.This issue affects Di Themes Demo Site Importer: from n/a through = 1.2...

WordPress Plugin: Di Themes Demo Site Importer – Cross-Site Request Forgery Vulnerability

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that provides the ability to host a personal blog site on a PHP and MySQL based server. A cross-site request forgery...

PT-2025-39531

Name of the Vulnerable Software and Affected Versions Di Themes Demo Site Importer versions through 1.2 Description A Cross-Site Request Forgery issue exists in Di Themes Demo Site Importer. This allows attackers to perform actions on behalf of authenticated users. Recommendations Update to a...

WordPress Di Themes Demo Site Importer plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Plugin Activation vulnerability

Cross Site Request Forgery CSRF to Plugin Activation vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Di Themes Demo Site Importer versions = 1.2...

Demo User Digital Zoom Studio Plugin XSS

The vulnerability of the Demo User Digital Zoom Studio plugin in the WordPress content management system is related to the lack of protective measures for the website’s structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2025-8446

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blazedemoimporterinstallplugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with...

@sit-onyx/demo-app (>=0.0.0, <=0.1.0-dev-20250919122003) potentially affected by CVE-2025-59414 via nuxt (4.0.3)

nuxt NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @sit-onyx/demo-app =0.0.0, =0.1.0-dev-20250919122003 Source cves: CVE-2025-59414 Source advisory: GHSA-P6JQ-8VC4-79F6...

@sit-onyx/demo-app (>=0.0.0, <=0.1.0-dev-20250919122003) potentially affected by CVE-2025-59414 via nuxt (4.0.3)

nuxt NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @sit-onyx/demo-app =0.0.0, =0.1.0-dev-20250919122003 Source cves: CVE-2025-59414 Source advisory: OSV:GHSA-P6JQ-8VC4-79F6...

@sit-onyx/demo-app (>=0.0.0, <=0.1.0-dev-20250919122003) potentially affected by CVE-2025-59414 via nuxt (4.0.3)

nuxt NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @sit-onyx/demo-app =0.0.0, =0.1.0-dev-20250919122003 Source cves: CVE-2025-59414 Source advisory: SNYK:JS-NUXT-12878602...

@sit-onyx/demo-app (>=0.0.0, <=0.1.0-dev-20250919122003), @zach-mac/zachscommoncomponents (1.0.4) potentially affected by CVE-2025-59414 via nuxt (>=4.0.0-rc.0, <=4.0.3)

nuxt NPM version =4.0.0-rc.0, =0.0.0, =0.1.0-dev-20250919122003 - @zach-mac/zachscommoncomponents 1.0.4 Source cves: CVE-2025-59414 Source advisory: MEND:CVE-2025-59414...

Malware in @hestjs/demo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @hestjs/demo (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d07b84a8fad4cf98766b909452076e1349e19abe6fa8b41b3a2d3326650fb05 Any computer that has this package installed or running should be considered fully compromised. All...

WordPress Blaze Demo Importer plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Plugin Install vulnerability discovered by wesley wcraft in WordPress Plugin Blaze Demo Importer versions = 1.0.12...

CVE-2025-55109

An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS12 keystore. A remote attacker with access to a signed third-party or demo...

CVE-2025-8446

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blazedemoimporterinstallplugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with...

CVE-2025-8446

CVE-2025-8446 concerns the Blaze Demo Importer plugin for WordPress (versions 1.0.12 or apply the vendor-provided fix, and validate that unauthorized plugin installations are disallowed.

CVE-2025-8446 Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blazedemoimporterinstallplugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with...