PT-2025-50875

In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...

CVE-2025-64199

Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through = 5.3.2...

EUVD-2025-36627

Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through = 5.3.2...

CVE-2025-64199

CVE-2025-64199 describes a Missing Authorization vulnerability in the WordPress wpresidence theme (WpResidence, wpresidence) affecting versions up to 5.3.2. The underlying issue is Broken/Incorrectly Configured Access Control that could allow unauthenticated access bypass. Reported with a base CV...

PT-2025-44244

Name of the Vulnerable Software and Affected Versions WpEstate wpresidence versions through 5.3.2 Description An authorization issue exists in WpEstate wpresidence, allowing exploitation of incorrectly configured access control security levels. Recommendations Update WpEstate wpresidence to a...

WordPress wpresidence Theme <= 5.3.2 is vulnerable to Broken Access Control

Software wpresidence Type Theme Vulnerable versions = 5.3.2 Fixed in 5.3.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-64199 Patch priority Low CVSS severity Low 5.3 Developer sc Internet Vivoo PSID 1c3b4381448c Credits João Pedro S Alcântara Kinorth...

EUVD-2014-6161

Malware in sbrugna...

EUVD-2025-25863

Malicious code in bioql PyPI...

EUVD-2024-0929

Malicious code in bioql PyPI...

CVE-2025-57820

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a proto property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype...

CVE-2025-57820 Svelte devalue vulnerable to prototype pollution

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a proto property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype...

CVE-2025-57820 Svelte devalue vulnerable to prototype pollution

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a proto property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype...

PT-2025-34819 · Unknown · Svelte Devalue

Name of the Vulnerable Software and Affected Versions: Svelte devalue versions prior to 5.3.2 Description: Svelte devalue is a utility library susceptible to prototype pollution. Passing a string to devalue.parse that represents an object with a proto property, without numeric index checking, can...

CVE-2024-40514

Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions...

WordPress plugin Bold Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-32442 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a slightly altered content type such as...

CVE-2024-40514

Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions...

WordPress RD Station plugin <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin RD Station versions = 5.3.2...

WordPress plugin RD Station 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-37935 · WordPress · Rd Station Plugin

Name of the Vulnerable Software and Affected Versions: RD Station plugin for WordPress versions up to, and including, 5.3.2 Description: The RD Station plugin for WordPress has a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping of post metaboxes added b...