CVE-2025-3164 Tencent Music Entertainment SuperSonic H2 Database Connection testConnect code injection

A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/semantic/database/testConnect of the component H2 Database Connection Handler. The manipulation leads to code...

CVE-2025-3164

Vulnerability details (CVE-2025-3164): Tencent Music Entertainment SuperSonic versions up to 0.9.8 contain a flaw in the H2 Database Connection Handler, specifically in the /api/semantic/database/testConnect function. The issue arises from the manipulation of an unknown functionality, leading to ...

PT-2025-14772 · Unknown +1 · H2 Database Connection Handler +1

Name of the Vulnerable Software and Affected Versions: Tencent Music Entertainment SuperSonic versions up to 0.9.8 Description: A critical issue affects some unknown functionality of the file "/api/semantic/database/testConnect" of the component H2 Database Connection Handler, leading to code...

PT-2025-18126

Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 15.4 Apple tvOS versions prior to 18.4 Apple macOS Ventura versions prior to 13.7.5 Apple iPadOS versions prior to 17.7.6 Apple macOS Sonoma versions prior to 14.7.5 Apple iOS versions prior to 18.4 Apple iPadOS...

CVE-2025-30591

Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through = 1.4.6...

CVE-2025-30591

Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through = 1.4.6...

CVE-2025-30591 WordPress Music Press Pro plugin <= 1.4.6 Broken Access Control Vulnerability

Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through = 1.4.6...

CVE-2025-30591 WordPress Music Press Pro plugin <= 1.4.6 Broken Access Control Vulnerability

Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through = 1.4.6...

CVE-2025-30591

CVE-2025-30591 — Missing Authorization in Music Press Pro (WordPress plugin) allows exploitation due to misconfigured access control. Affected: Music Press Pro versions 1.4.6 and earlier (from n/a to 1.4.6). According to provided metrics, the CVSSv3.1 base score is 5.3 (Medium): Attack Vector NET...

WordPress Music Press Pro plugin <= 1.4.6 Broken Access Control Vulnerability

WordPress Music Press Pro plugin = 1.4.6 Broken Access Control Vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Music Press Pro versions = 1.4.6...

WordPress plugin Music Press Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-2103

The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusicajax function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with...

Friday Squid Blogging: SQUID Band

A bagpipe and drum band: SQUID transforms traditional Bagpipe and Drum Band entertainment into a multi-sensory rush of excitement, featuring high energy bagpipes, pop music influences and visually stunning percussion! As usual, you can also use this squid post to talk about the security stories i...

CVE-2025-2103 SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update

The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusicajax function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with...

CVE-2025-2103

CVE-2025-2103 – SoundRise Music (WordPress) Vulnerability exists in SoundRise Music plugin for WordPress (all versions &lt;= 1.6.11). A missing capability check in onMusic_ajax() allows authenticated users with subscriber-level access and above to modify arbitrary options, enabling privilege esca...

CVE-2025-2103 SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update

The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusicajax function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with...

WordPress plugin SoundRise Music 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress SoundRise Music plugin <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Plugin SoundRise Music versions = 1.6.11...

When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.

Published in 2019, the autodzee package is a Python librarythat bypasses Deezer API restrictions to download music.The package was found to exfiltrate user data to a hardcoded server,which could be used for malicious purposes...

Malicious PyPI Package "automslc" Enables 104K+ Unauthorized Deezer Music Downloads

Cybersecurity researchers have flagged a malicious Python library on the Python Package Index PyPI repository that facilitates unauthorized music downloads from music streaming service Deezer. The package in question is automslc, which has been downloaded over 104,000 times to date. First publish...