PT-2025-52271

Missing Authorization vulnerability in Sparkle WP Sparkle FSE allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sparkle FSE: from n/a through 1.0.9...

WordPress plugin Sparkle FSE 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-52270

Name of the Vulnerable Software and Affected Versions Sparkle WP Construction Light versions through 1.6.7 Description A missing authorization issue exists in Sparkle WP Construction Light, allowing exploitation of incorrectly configured access control security levels. Recommendations Update...

WordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Denver Jackson in WordPress Theme Sparkle FSE versions = 1.0.9...

EUVD-2025-28358

Malicious code in bioql PyPI...

EUVD-2023-34891

Malicious code in bioql PyPI...

EUVD-2023-36397

Malicious code in bioql PyPI...

EUVD-2025-29540

Malicious code in bioql PyPI...

EUVD-2025-29539

Malicious code in bioql PyPI...

EUVD-2025-9863

Malicious code in bioql PyPI...

EUVD-2025-24714

Malicious code in bioql PyPI...

EUVD-2023-32112

Malicious code in bioql PyPI...

EUVD-2024-52106

Malicious code in bioql PyPI...

EUVD-2024-47267

Malicious code in bioql PyPI...

EUVD-2021-7545

Malicious code in bioql PyPI...

EUVD-2023-34895

Malicious code in bioql PyPI...

EUVD-2025-0232

Malicious code in bioql PyPI...

CVE-2025-10015

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client...

CVE-2025-10016

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the Downloader.xpc service. A local unprivileged attacker can access and copy files protected by TCC permissions by registering the service globally and exploiting the lack of client validation. Workaround Th...