Authorization Bypass Through User-Controlled Key

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient capability checks in the RSS block. An attacker can access and view additional RSS feeds by exploiting the IDOR vulnerability...

CVE-2025-3636

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...

CVE-2025-3636 Moodle: idor in moodle rss block allows unauthorized access to rss feeds

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...

CVE-2025-3636 Moodle: idor in moodle rss block allows unauthorized access to rss feeds

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...

CVE-2025-3636

CVE-2025-3636 concerns Moodle where an improper capability check allows an unauthorized user to access and view RSS feeds via an IDOR in the RSS block. The connected documents (BIT-MOODLE-2025-3636, GHSA-CHMF-M33P-PH8M, CNVD-style summaries) consistently describe an access control flaw enabling v...

CVE-2025-3636 Moodle: idor in moodle rss block allows unauthorized access to rss feeds

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...

CVE-2025-3636

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...

PT-2025-17912

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw was found in the software, allowing unauthorized users to access and view RSS feeds due to insufficient capability checks. Recommendations At the moment, there is no information about a...

GHSA-847X-X4JG-6GF4 croogo Host header injection

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component...

Host Header Injection

Overview croogo/croogo is an Open Source CMS built for everyone. Affected versions of this package are vulnerable to Host Header Injection in the feed.rss component, which takes the content of the -H argument in a request and passes it through to the element in a response without filtering. An...

Croogo 安全漏洞

Croogo is Croogo open source a set of CakePHP framework based on the development of content management system CMS. The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. Croogo version 3.0.2 security vulnerabilities , the...

CVE-2025-39418

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through = 0.06...

CVE-2025-39418 WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager allows Stored XSS. This issue affects RSS Manager: from n/a through 0.06...

CVE-2025-39418 WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through = 0.06...

CVE-2025-39418

CVE-2025-39418 is a CSRF to Stored XSS vulnerability in WordPress RSS Manager plugin (versions 0.06 and earlier). The linked sources (NVD, Red Hat, Patchstack, CVE listings) confirm the issue and affected product, but none supply a specific patched version. The core impact is stored XSS triggered...

WordPress plugin RSS Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-16985 · Unknown · Ajayver Rss Manager

Name of the Vulnerable Software and Affected Versions: ajayver RSS Manager versions 0.06 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 0.06 and earlier, update to a version that fixes this issue, as no...

PT-2025-20522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been identified in the Linux kernel, specifically in the txgbe probe function. The leak occurs when the txgbe sw init function is called, allocating memory for th...

PT-2025-20524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been identified in the Linux kernel, specifically in the ngbe probe function. The leak occurs when the ngbe sw init function is called, allocating memory for rss...

Moodle 4.3.x < 4.3.8 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.14, 4.2.x prior to 4.2.11, 4.3.x prior to 4.3.8, or 4.4.x prior to 4.4.4. It is, therefore, affected by multiple vulnerabilities. - An IDOR when fetching report schedules. - Some users can...