PT-2025-5511 · Unknown · Hasthemes Extensions For Cf7

Name of the Vulnerable Software and Affected Versions: HasThemes Extensions For CF7 versions 3.2.0 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to perform Server Side Request Forgery. Recommendations: For versions 3.2.0 and...

CVE-2025-23888: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through = 0.6...

CVE-2025-24695: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through = 3.2.0...

PT-2025-5171 · Unknown · Notfound Custom Page Extensions

Name of the Vulnerable Software and Affected Versions: NotFound Custom Page Extensions versions 0.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables attackers ...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (4.0.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (4.0.0) +270 more potentially affected by CVE-2024-53299 via org.apache.wicket:wicket-core (>=10.0.0, <=10.2.0)

org.apache.wicket:wicket-core MAVEN version =10.0.0, =1.0.0, =4.0.3, =4.0.4, =7.0.3, =7.0.3, =7.0.3, =7.0.3, =0.2, =0.6.5 and more Source cves: CVE-2024-53299 Source advisory: GHSA-9CXR-76PM-J3WF...

Able to attach restricted files to Jira issues from Email

h3. Issue Summary From 9.15, admins can now restrict unwanted file extensions from being uploaded through issues. However, the restriction does not work when the attachment is sent via email. The files with restricted extensions are being uploaded to Jira issues. Reference:Restrict unwanted file...

Cross-Site Request Forgery (CSRF)

typo3/cms-extensionmanager is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper handling of HTTP methods for state-changing actions and the backend user interface being susceptible to malicious URLs under specific misconfigurations, allows an attacker to retrieve...

OESA-2025-1046 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain...

OESA-2025-1047 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain...

Google Chrome Security Bypass Vulnerability (CNVD-2025-06042)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security bypass vulnerability that is caused due to insufficient data validation in extensions. An attacker can exploit this vulnerability to bypass security restrictions...

WordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Custom Page Extensions versions = 0.6...

Chromium: CVE-2025-0446 Inappropriate implementation in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2025-0443 Insufficient data validation in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE CVE-2025-0443

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

A flaw was found in the aiohttp package. The Python parser parses newlines in chunk extensions incorrectly, which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed, for example, without the usual C extensions, or...

DEBIAN-CVE-2025-0443

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0446

Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2025-0446

Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2025-0446

Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2025-0446

An inappropriate implementation in the Extensions component of Google Chrome prior to version 132.0.6834.83 allows a remote attacker to perform UI spoofing . By convincing a user to engage in specific UI gestures, an attacker can use a crafted Chrome Extension to misrepresent the user interface. ...