SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for apache-commons-io (SUSE-SU-SUSE-RU-2025:1150-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:1150-1 advisory. apache-commons-io was updated from version 2.15.1 to 2.18.0: - Key changes across versions: Clean...

Prototype Pollution

Overview org.webjars.npm:estree-util-value-to-estree is a Convert a JavaScript value to an estree expression Affected versions of this package are vulnerable to Prototype Pollution via the valueToEstree function. An attacker can manipulate the prototype of an object by passing a specially crafted...

Chromium: CVE-2025-3070 Insufficient validation of untrusted input in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2025-2071

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

CVE-2025-3070

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-3070

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-3070

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-3070

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-3070

CVE-2025-3070 affects Google Chrome/Chromium extensions, where insufficient validation of untrusted input in Extensions enables privilege escalation via a crafted HTML page. Affected product surface is Chromium-based Extensions code prior to 135.0.7049.52. The vulnerability’s root cause is input ...

Google Chrome 输入验证错误漏洞

Google Chrome is a web browser from Google Inc. in the United States. Google Chrome suffers from an input validation error vulnerability that stems from insufficient validation of untrustworthy input in Extensions. An attacker can exploit this vulnerability to obtain sensitive information...

Google Chrome < 135.0.7049.41 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 135.0.7049.41. It is, therefore, affected by multiple vulnerabilities as referenced in the 202504stable-channel-update-for-desktop advisory. - Inappropriate implementation in Downloads in Google Chrome prior to...

chromium -- multiple security fixes

Chrome Releases reports: This update includes 13 security fixes: 376491759 Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer TU Wien on 2024-10-31 401823929 Medium CVE-2025-3068: Inappropriate implementation in Intents. Reported by Simon Rawet on 2025-03-...

CVE-2025-2071 OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

CVE-2025-2332

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attacke...

CVE-2025-1913

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'formdata' parameter This makes it possible for authenticated attacker...

CVE-2024-13889

The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybeunserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, t...

VulnCheck KEV: CVE-2024-8353

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for...

PT-2025-13033 · WordPress · Export All Posts

Name of the Vulnerable Software and Affected Versions: Export All Posts, Products, Orders, Refunds & Users plugin for WordPress versions up to, and including, 2.13 Description: The issue is related to PHP Object Injection via deserialization of untrusted input in the returnMetaValueAsCustomerInpu...

CVE-2025-1913

CVE-2025-1913 affects the WordPress plugin Product Import Export for WooCommerce – Import Export Product CSV Suite. The issue is a PHP Object Injection via deserialization of untrusted input in the form_data parameter, exploitable by authenticated administrators and higher. A POP chain is not pre...

WordPress plugin Product Import Export for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...