GHSA-99VM-5V2H-H6R6 Directus allows updates to non-allowed fields due to overlapping policies

Summary If there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is allowed to update the superset of fields allowed by any of the policies. E.g. have one policy...

MAL-2025-1490 Malicious code in modulous (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdabc10cd9ca2355a05df4fa5654942457a4635c6beeca4affd63d76ae733d11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in publish-private-provider-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bab9547b7dc338e24a9c420f123daff70b59524719d6b302478d7987bf52e66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1495 Malicious code in react-native-android-library-simpl-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4460dc946645a2b0bcd6489a7ae7a24c7c2803c369d27f2efa3de46ab7735558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1480 Malicious code in fohost (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 381794f08a206c0fe6726ea73aa3391fbf97c17ae26096768ee4fc054d2c007b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13726

The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-1441

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wprfilterwooproducts' function. This makes it possible for unauthenticated attacke...

CVE-2024-13684

CVE-2024-13684 (Reset plugin for WordPress) has a CSRF vulnerability present in all versions up to 1.6 due to missing nonce validation on reset_db_page(); unauthenticated attackers could cause the site administrator to trigger database resets, affecting tables such as comments, themes, plugins, e...

PT-2025-6800 · WordPress · Mortgage Lead Capture System

Name of the Vulnerable Software and Affected Versions: Mortgage Lead Capture System plugin for WordPress versions up to, and including, 8.2.10 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wprequal reset defaults action. This...

MAL-2025-1445 Malicious code in toobit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f762603da623d8fe137db26b48c17bb54cead19699d368690d433f939e45316f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13726

The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-1336

A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimgaction in the library lib/admin/imageadmin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The explo...

CVE-2025-1335 CmsEasy file_admin.php deleteimg_action path traversal

A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimgaction in the library lib/admin/fileadmin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been...

PT-2025-6879 · Cmseasy · Cmseasy

Name of the Vulnerable Software and Affected Versions: CmsEasy version 7.7.7.9 Description: A vulnerability has been found in the function deleteimg action in the library lib/admin/image admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched...

PT-2025-6878 · Cmseasy · Cmseasy

Name of the Vulnerable Software and Affected Versions: CmsEasy version 7.7.7.9 Description: A vulnerability was found in the function deleteimg action in the library lib/admin/file admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack...

CVE-2024-31144

For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk Image VDI inside ...

CVE-2024-13769

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...

MAL-2025-1364 Malicious code in grammyjs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d05f6c295e765b1889ffc72832434e365ea15f5aa6f8a6a555f42364c86a2c17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13374

The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptmgetFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read...

CVE-2024-13769

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...