CVE-2025-25907: Cross-Site Request Forgery (CSRF)

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25908: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

CVE-2024-10326

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveoptions and resetwidgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...

CVE-2024-11640

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change...

CVE-2024-13908

The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

WordPress RomethemeKit For Elementor plugin <= 1.5.3 - Missing Authorization in save_options and reset_widgets vulnerability

Missing Authorization in saveoptions and resetwidgets vulnerability discovered by WordFence in WordPress Plugin RTMKit versions = 1.5.3...

PT-2025-10415

Name of the Vulnerable Software and Affected Versions The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress versions up to, and including, 3.1.7 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save to...

PT-2025-10408

Name of the Vulnerable Software and Affected Versions FooGallery – Responsive Photo Gallery plugin versions prior to 2.4.30 Description The issue allows authenticated attackers with granted access and above to update arbitrary post and page content due to missing validation on a user-controlled k...

PT-2025-10424

Name of the Vulnerable Software and Affected Versions SMTP by BestWebSoft plugin for WordPress versions up to 1.1.9 Description The issue arises from missing file type validation in the save options function, allowing authenticated attackers with Administrator-level access and above to upload...

CVE-2025-2085

A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The manipulation of the argument redirectUrl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

OESA-2025-1258 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file wi...

PT-2025-10049

Name of the Vulnerable Software and Affected Versions UiPress lite versions up to, and including, 3.5.04 Description The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the uip save form as option function. This...

CVE-2025-2085: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The manipulation of the argument redirectUrl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

PT-2025-10087

Name of the Vulnerable Software and Affected Versions StarSea99 starsea-mall version 1.0 Description A problematic vulnerability has been discovered, affecting an unknown part of the file /admin/carousels/save. The issue involves the manipulation of the redirectUrl argument, leading to cross-site...

SUSE CVE-2022-49175

In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in devicepmcheckcallbacks The function devicepmcheckcallbacks can be called under the spin lock in the reported case it happens from genpdadddevice - devpmdomainset, when the genpd uses spinlocks rather...

SUSE CVE-2022-49219

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix memory leak during D3hot to D0 transition If 'vfiopcicoredevice::needspmrestore' is set PCI device does not have NoSoftReset bit set in its PMCSR config register, then the current PCI state will be saved locally in...

SUSE CVE-2022-49559

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal operation, the sanity check is...

PT-2025-9040

Name of the Vulnerable Software and Affected Versions Cardealer theme for WordPress versions up to, and including, 1.6.4 Description The issue is related to a missing capability check on the save settings function, which allows authenticated attackers with subscriber-level access and above to...

PT-2025-8910 · WordPress · Sakolawp

Name of the Vulnerable Software and Affected Versions: SakolaWP plugin for WordPress versions prior to 1.0.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save exam setting and delete exam setting actions. This allows...

CVE-2025-25818

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...