CVE-2025-23818

Cross-Site Request Forgery CSRF vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through = 1.0.3...

CVE-2024-56359

grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier meaning for example Ctrl+click could have their account compromised, since the link could use the javascript: scheme and be evaluated in the context...

CVE-2025-23818

Cross-Site Request Forgery CSRF vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through = 1.0.3...

CVE-2025-23818 WordPress More Link Modifier plugin <= 1.0.3 - CSRF to Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through = 1.0.3...

CVE-2025-23818

CVE-2025-23818 affects the WordPress plugin More Link Modifier . The issue is a combination of Cross-Site Request Forgery (CSRF) that facilitates a Stored XSS vulnerability, impacting versions from n/a through 1.0.3 . Exploitation details and patch information are not provided in the supplied doc...

CVE-2025-23818 WordPress More Link Modifier plugin <= 1.0.3 - CSRF to Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through = 1.0.3...

WordPress More Link Modifier plugin <= 1.0.3 - CSRF to Cross-Site Scripting vulnerability

CSRF to Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin More Link Modifier versions = 1.0.3...

CVE-2025-23818: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through = 1.0.3...

PT-2025-5116

Name of the Vulnerable Software and Affected Versions Peggy Kuo More Link Modifier versions n/a through 1.0.3 Description The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-56359 Cross-site Scripting vulnerability through HyperLink cells in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier meaning for example Ctrl+click could have their account compromised, since the link could use the javascript: scheme and be evaluated in the context...

CVE-2024-50343 Incorrect response from Validator when input ends with `\n` in symfony/validator

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the D...

CVE-2024-50343

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the D...

GHSA-G3RH-RRHP-JHH9 Symfony has an incorrect response from Validator when input ends with `\n`

Description It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Resolution Symfony now uses the D regex modifier to match the entire input. The patch for this issue is available here for branch 5.4. Credits We would li...

CVE-2024-50343: Improper Input Validation

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the D...

CVE-2022-48849 drm/amdgpu: bypass tiling flag check in virtual display case (v2)

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bypass tiling flag check in virtual display case v2 vkms leverages common amdgpu framebuffer creation, and also as it does not support FB modifier, there is no need to check tiling flags when initing framebuffer when...

CVE-2024-26895

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces wilcnetdevcleanup currently triggers a KASAN warning, which can be observed on interface registration error path, or simply by removing the...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: spark-operator, prometheus-statsd-exporter, rqlite, crossplane-provider-aws-cloudfront, logstash-exporter, prometheus-node-exporter, crossplane-provider-aws-rds, fuse-overlayfs-snapshotter, sigstore-scaffolding, trillian-fips, falcosidekick-fips, capslock, hubble-ui,...

InitiCore.liquidate uses stale toShares function

Lines of code Vulnerability details Proof of Concept When position is going to be liquidated, then liquidator provides poolToRepay and poolOut. He wants to repay some amount to poolToRepay and get shares from poolOut back according to repaid amount + bonus. ILendingPoolpoolOut.toShares function i...

Missing onlyOwner Modifier Will Give Access To Any Malicious User To Change UnwrapFee Immediately

Lines of code Vulnerability details Impact Any address can call the function changeUnwrapFee and modify or influence the unwrap fee, compromising the intended governance structure and allowing malicious users or entities to favourably adjust fees to their advantage for token unwrapping. Proof of...

The getPriceAndFee() function performs calculations without implementing reentrancy protection.

Lines of code Vulnerability details Impact An attacker could call getPriceAndFee multiple times concurrently, read intermediate state, and craft calls to exploit any assumptions made between calculations. This could undermine the intended bonding curve pricing logic. Proof of Concept getPriceAndF...