7135 matches found
BIT-JENKINS-2025-27624
A cross-site request forgery CSRF vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets e.g., Build Queue and Build Executor Status widgets...
CVE-2025-0912
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'cardaddress' parameter. This makes it possible for unauthenticated attackers to inject a PHP...
Linux Distros Unpatched Vulnerability : CVE-2024-58012
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Each cpu DAI should associate with a widget. However, the topology might not create the righ...
CVE-2025-27624
CVE-2025-27624 : Jenkins versions 2.499 and earlier, and LTS 2.492.1 and earlier, are affected by a CSRF vulnerability that lets an attacker toggle the collapsed/expanded state of sidepanel widgets (e.g., Build Queue, Build Executor Status) in affected users. The issue arises from the HTTP endpoi...
CVE-2025-27624
A cross-site request forgery CSRF vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets e.g., Build Queue and Build Executor Status widgets...
CVE-2025-25099
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting XSS.This issue affects Appointment Buddy Widget: from n/a through =...
Malicious code in zz-aipage-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f712f52c5a683ddfe543f58cb84fdf0f1e39545dcda7c102d4904065d87b775 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2199 Malicious code in zz-aipage-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f712f52c5a683ddfe543f58cb84fdf0f1e39545dcda7c102d4904065d87b775 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2200 Malicious code in zz-react-custom-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c52c19012a2e7ff5c32331c8fb8bdf0ec9811d36c029f8d2ff30de7c98fdf6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in zz-react-custom-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c52c19012a2e7ff5c32331c8fb8bdf0ec9811d36c029f8d2ff30de7c98fdf6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in v1ue-custom-widget-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f7e56b04ae3ca44fba371adba340a3933b9fb3e7899bc2da0a2c868373970b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vue-custom-widget-template1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b54ec1679cbeb92bfd2aaa272446918c32899d07a1fc5e4211c07323790f26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2117 Malicious code in my-custom-vue-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45c516cbd7bda6255ce1f5a2b53f65970a24bb84aa4fc373041f73a440b8ae41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2138 Malicious code in vue-custom-widget-template1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b54ec1679cbeb92bfd2aaa272446918c32899d07a1fc5e4211c07323790f26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-0912
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'cardaddress' parameter. This makes it possible for unauthenticated attackers to inject a PHP...
CVE-2025-0912 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'cardaddress' parameter. This makes it possible for unauthenticated attackers to inject a PHP...
PT-2025-9590
Name of the Vulnerable Software and Affected Versions Donations Widget plugin for WordPress versions up to, and including, 3.19.4 Description The issue arises from improper handling of user-supplied data within the donation form, particularly in the card address parameter. This flaw allows...
CVE-2025-25099
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting XSS.This issue affects Appointment Buddy Widget: from n/a through =...
CVE-2025-23718
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mancx Mancx AskMe Widget mancx-askme-widget allows Reflected XSS.This issue affects Mancx AskMe Widget: from n/a through = 0.3...
CVE-2025-25099 WordPress Appointment Buddy Widget By Accrete plugin <= 1.2. - Reflected Cross-Site Scripting vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in accreteinfosolution Appointment Buddy Widget allows Reflected XSS. This issue affects Appointment Buddy Widget: from n/a through 1.2...