WordPress plugin All Bootstrap Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

JVN#23839833: SXF Common Library vulnerable to improper input data handling

SXF Common Library provided by General Incorporated Association OCF is vulnerable to improper input data handling CWE-237. Impact If a product using the library reads a crafted file, the product may be crashed. Solution Apply the workaround Applying the following workaround may mitigate the impac...

WordPress Export All Posts, Products, Orders, Refunds & Users Plugin <= 2.9 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by l8BL in WordPress Plugin WP Ultimate Exporter versions = 2.9...

WordPress plugin All Embed – Elementor Addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2025-5431 · Bplugins · Bplugins All Embed – Elementor Addons

Name of the Vulnerable Software and Affected Versions: bPlugins All Embed – Elementor Addons versions 1.1.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means an attacker can...

WordPress WP All Import Pro plugin <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin WP All Import Pro versions = 4.9.7...

CVE-2024-8722 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload

The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8722 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload

The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Delete All Posts plugin <= 1.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Delete All Posts versions = 1.1.1...

WordPress all-in-one-box-login plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin all-in-one-box-login versions = 2.0.1...

SUSE CVE-2025-22134

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visu...

IceCMS 安全漏洞

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS version v2.2.0, which originates from improper access control in component /square/getAllSquare/circle. An attacker...

The vulnerability of the Drupal CMS system’s “Download All Files” module, related to the lack of authentication, allows attackers to bypass security restrictions and execute a forced browsing attack.

The vulnerability of the “Download All Files” module in Drupal systems is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

AZL-55582 CVE-2025-22134 affecting package vim for versions less than 9.1.0791-3

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visu...

UBUNTU-CVE-2025-22134

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visu...

UBUNTU-CVE-2024-53687

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix IPIs usage in kfenceprotectpage flushtlbkernelrange may use IPIs to flush the TLBs of all the cores, which triggers the following warning when the irqs are disabled: 3.455330 WARNING: CPU: 1 PID: 0 at kernel/smp.c:815...

PT-2025-4371

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.1.1003 Description The issue is related to a heap-buffer overflow in Vim when switching to other buffers using the :all command while visual mode is still active. This occurs because Vim does not properly end visual mod...

CVE-2024-13303 Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2...

CVE-2024-13303

CVE-2024-13303 affects the Drupal module “Download All Files” (vulnerable: 0.0.0–2.0.1) and is due to a Missing Authorization flaw that enables forceful browsing to access files that should be protected. Public references confirm the issue as an access bypass vulnerability in this contrib module,...

CVE-2024-13303 Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2...