UBUNTU-CVE-2023-54280

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential race when tree connecting ipc Protect access of TCPServerInfo::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in treeconnectdfstarget. Als...

CVE-2025-15006

creationtimestamp| type| source ---|---|--- 2025-12-22 01:35:50+00:00| seen| https://infosec.exchange/users/offseq/statuses/115760650592789467 2025-12-22 01:35:51+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mak3tbobmk2j 2025-12-22 02:34:07+00:00| seen|...

CVE-2025-7733 WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'csupdateapplicationstatuscallback' due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2025-56096

creationtimestamp| type| source ---|---|--- 2025-12-11 18:33:14+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115702365711663519...

CVE-2025-34393

creationtimestamp| type| source ---|---|--- 2025-12-10 15:52:05+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115696069836441774 2025-12-10 17:07:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7nkcd233r2c...

CVE-2025-65287

creationtimestamp| type| source ---|---|--- 2025-12-09 15:56:30+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115690424892712546...

CVE-2025-65804

creationtimestamp| type| source ---|---|--- 2025-12-08 17:46:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115685195052401612 2025-12-08 19:52:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7iskxtus72x...

CVE-2025-13666

CVE-2025-13666 refers to the Helloprint WordPress plugin (WordPress Helloprint plugin) with vulnerability in versions up to and including 2.1.2. The issue is Missing Authorization due to a publicly registered REST API endpoint that does not verify request authenticity, enabling unauthenticated ac...

CVE-2025-14092

creationtimestamp| type| source ---|---|--- 2025-12-05 16:13:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667841253149237...

CVE-2025-12355

CVE-2025-12355 refers to the Payaza WordPress plugin. The vulnerability is a missing capability check on the AJAX endpoint wp_ajax_nopriv_update_order_status, allowing unauthenticated attackers to modify order statuses. Affected versions are all up to and including 0.3.8. The public reports descr...

CVE-2025-12355 Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...

WordPress Payaza plugin <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update vulnerability

Missing Authorization to Unauthenticated Order Status Update vulnerability discovered by Legion Hunter in WordPress Plugin Payaza versions = 0.3.8...

CVE-2025-57850

creationtimestamp| type| source ---|---|--- 2025-12-02 19:16:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115651575723555326 2025-12-02 21:35:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6zvkp3lak2k...

CVE-2024-59373

creationtimestamp| type| source ---|---|--- 2025-11-25 15:05:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115610951630509357...

CVE-2025-12634 Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2025-199565

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-12634

The CVE-2025-12634 entry concerns the WordPress plugin Refund Request for WooCommerce. A missing capability check in the update_refund_status function affects all versions up to and including 1.0, allowing authenticated users with Subscriber-level access or higher to modify refund statuses to app...

WordPress Refund Request for WooCommerce plugin <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update vulnerability

Missing Authorization to Authenticated Subscriber+ Refund Status Update vulnerability discovered by Powpy in WordPress Plugin Refund Request for WooCommerce versions = 1.0...

CVE-2025-65222

creationtimestamp| type| source ---|---|--- 2025-11-20 15:10:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115582661903555688...

CVE-2025-12392

CVE-2025-12392 affects the WordPress plugin “Cryptocurrency Payment Gateway for WooCommerce.” The root cause is a missing capability check in the handle_optin_optout() function, allowing unauthenticated attackers to modify tracking opt-in/out settings in all versions up to 2.0.22. The practical i...