CVE-2025-62052

CVE-2025-62052 : WordPress plugin One Page Express Companion (≤1.6.43) has a Missing Authorization (Broken Access Control) vulnerability. The public CVSS 3.1 vector shows Network access, Low attack complexity, Low privileges required, no user interaction, and impact limited to confidentiality (C:...

CVE-2025-49917 WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through = 5.9.5...

CVE-2025-49917 WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through = 5.9.5...

CVE-2025-49917

CVE-2025-49917 describes a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin Icegram Express Pro, specifically in the email-subscribers-premium component. Affected versions are Icegram Express Pro

CVE-2025-49917: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through = 5.9.5...

CVE-2025-62052: Missing Authorization

Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through = 1.6.43...

WordPress Plugin Icegram Express Pro 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

PT-2025-43183

Name of the Vulnerable Software and Affected Versions Icegram Icegram Express Pro versions through 5.9.5 Description A Server-Side Request Forgery SSRF issue exists in Icegram Icegram Express Pro email-subscribers-premium. This allows for Server Side Request Forgery. Recommendations Update Icegra...

WordPress plugin One Page Express Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A security...

Node.js Express DevMode Enabled

Node.js Express installed on the remote host is configured to operate in development mode devMode. While this environment can help speed up development of web applications, it can leak information about the underlying web applications as well as the installation of Express, Node.js. No source dat...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987607)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987607 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ipq8074: fix PCI-E clock oops Fix PCI-E clock related kernel oops that are caused by a...

test-reflected-xss-nodejs

It is an offensive tool for web application security testing. Th...

CVE-2025-61922

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in...

EUVD-2025-34839

Malicious code in swagger-express-cli npm...

MAL-2025-48439 Malicious code in swagger-express-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df82c080a9679b5742e676bdbeae1f2d4f81a3ba9794c93d5c12deb3df539951 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview swagger-express-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in swagger-express-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df82c080a9679b5742e676bdbeae1f2d4f81a3ba9794c93d5c12deb3df539951 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-39984

In the Linux kernel, the following vulnerability has been resolved: net: tun: Update napi-skb after XDP process The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skbresetmacheader include/linux/skbuff.h:3150 inline BUG: KASAN: slab-use-after-free in napifragsskb net/core/gro.c:723...

PrestaShop Checkout allows customer account takeover via email

Impact Missing validation on Express Checkout feature allows silent log-in Affected versions The issue was introduced in PrestaShop Checkout 1.3.0 . All versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the Express Checkout feature. An attacker can bypass the login procedure via email. Note: Versions 9.4.3.1 through 9.4.3.3, which used the build numbering scheme prior to 2025, are also...