PT-2025-18547 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential memory leak in the Linux kernel has been resolved. The issue occurred in the drm dev init function, where a reference count added by device get was not properly released du...

ADC-13.1-Error "Custom header name is too long" with rewrite action DELETE_HTTP_HEADER in Netscaler

When you want to delete HTTP header "X-Permitted-Cross-Domain-Policies" with rewrite action DELETEHTTPHEADER, Netscaler prompts this error "Custom header name is too long"...

CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 Remote Code Execution

CraftCMS version 3.x prior to 3.9.15 or 4.x prior to 4.14.15 or 5.x prior to 5.6.16 is vulnerable to a Remote Code Execution RCE in the action endpoint. No source data...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-2594

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID...

PT-2025-17957 · WordPress · Edumall

Name of the Vulnerable Software and Affected Versions: Edumall theme for WordPress versions up to, and including, 4.2.4 Description: The issue allows unauthenticated attackers to include and execute arbitrary PHP files on the server via the template parameter of the 'edumall lazy load template'...

CVE-2025-24619

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webheadcoder WP Log Action wp-log-action allows Reflected XSS.This issue affects WP Log Action: from n/a through = 0.51...

Authorization Bypass Through User-Controlled Key

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the revoke action process. An attacker can access sensitive user information and disrupt user access by exploiting improper access control...

Moodle has a CSRF risk in Brickfield tool's analysis request action

A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery CSRF risk...

GHSA-M8QH-HX4C-H9HR Moodle has a CSRF risk in Brickfield tool's analysis request action

A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery CSRF risk...

MAL-2025-3387 Malicious code in dowload_ebok_a_bela_e_a_fera_by_elizabeth_rudnick_evan_spiliotopoulos_stephen_ch_9ooey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3075ed01e988b75ffe573ce85b459ad0e7a1f3a4811aeff563b24af9d9ee54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3392 Malicious code in dowload_ebok_si_la_verdad_te_incomoda_no_leas_este_libro_by_armando_r_manjarres_0qwta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 423ed02534dc5f69e700f584aa2650eeb9221a31037dbeb366660c166801552d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the updateChannelAction function, which does not sufficiently check user permissions before executing a delete operation. Any user can delete posts containing actions posted by the Playbooks bot. Remediation...

Franka Emika Robot 安全漏洞

Franka Emika Robot is a robot from the German company Franka. A security vulnerability exists in Franka Emika Robot that stems from a lack of authorization and allows an unauthenticated, remote attacker to connect over HTTPS and trigger a close button resulting in a denial of service attack...

PT-2025-17708 · WordPress · Woocommerce Automatic Order Printing

Name of the Vulnerable Software and Affected Versions: WooCommerce Automatic Order Printing plugin versions up to, and including, 4.1 Description: The issue is related to Insecure Direct Object Reference, which allows authenticated attackers with Subscriber-level access and above to view other...

MAL-2025-3290 Malicious code in nsdhqhlqqka (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f13c553d9b4b49c22bdffaa566e85eafa6970dedeab6c7f1102dfbe4bc70d60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2017-12792

Multiple cross-site request forgery CSRF vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 linkname, 2 url, or 3 title parameter in an add action to linksmanage.php...

Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps afte...

CVE-2025-2594

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID...