12265 matches found
CVE-2025-62690 Open redirect in error page when link opened in new tab
Mattermost versions 10.11.x = 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab...
CVE-2025-62690
Summary: CVE-2025-62690 affects Mattermost versions 10.11.x up to 10.11.4, where the application fails to validate redirect URLs on the /error page. This vulnerability can allow an attacker to redirect a user’s browser to a malicious site via a crafted link opened in a new tab. The issue is consi...
task-3-security-testing
Security Testing for Web Applications Task 3: CODTECH Inte...
CVE-2025-14002
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...
CVE-2025-14385 WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 10.2.3 due to insufficient input sanitization and output escaping on user-supplied attributes in the wprm-recipe-roundup-item shortcode. This makes ...
PT-2025-51812
Name of the Vulnerable Software and Affected Versions WP Recipe Maker plugin for WordPress versions up to and including 10.2.3 Description The WP Recipe Maker plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping on...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost 10.11.4 and prior versions 10.11.x that originates from a redirect URL on an unverified/error page, which could result in redirecting a victim to a malicio...
Oracle Linux 10 : keylime (ELSA-2025-23201)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-23201 advisory. 7.12.1-15 - Registrar allows identity takeover via duplicate UUID registration 7.12.1-14 - Properly fix malformed TPM certificates workaround 7.12.1-13 - Avoi...
UBUNTU-CVE-2025-64520
GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch...
CVE-2025-64520
GLPI CVE-2025-64520 affects versions 9.1.0 up to (but not including) 10.0.21, where an unauthorized API user can read all knowledge base entries. Root cause: insufficient API authorization. Impact: confidentiality high; integrity/availability not affected per disclosure. Remediation: upgrade to 1...
CVE-2025-68142
CVE-2025-68142 involves PyMdown Extensions (Python-Markdown) where the figure caption extension (pymdownx.blocks.caption) exposes a ReDO S vulnerability in versions before 10.16.1. The flaw can cause long processing delays when handling unchecked user content, potentially leading to hangs; exploi...
CVE-2025-68236
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down PC=3 According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with PowerCondition=3 and await a response. - Asserting...
CVE-2025-68236
CVE-2025-68236 affects the Linux kernel’s SCSI UFS stack, specifically the ufs-qcom driver. The issue arises during the UFS power-down sequence: after SSU Power_Condition=3, hardware reset (HWRST) can wake the device firmware, causing a transient surge in ICCQ current. If the regulator is still e...
CVE-2025-68236 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down PC=3 According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with PowerCondition=3 and await a response. - Asserting...
CVE-2025-14002
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...
CVE-2025-14002 WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...
EUVD-2025-203621
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...
CVE-2025-14002
CVE-2025-14002 — The WPCOM Member plugin for WordPress allows authentication bypass via brute force. Root cause: weak OTP generation (6 digits) with a 10-minute validity and no rate limiting on verification attempts. Impact: unauthenticated attackers can log in as any user (including admins) if t...
CVE-2025-14002 WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP One-Time Password generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verificatio...