CVE-2025-8397

The CVE concerns the WordPress plugin Save as PDF Button. All versions up to 1.9.2 are vulnerable to Stored Cross-Site Scripting via the restpackpdfbutton shortcode due to insufficient sanitization/escaping of user attributes. Authenticated attackers with contributor-level access (or higher) can ...

CVE-2025-8397 Save as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode

The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Save as PDF Button plugin <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via restpackpdfbutton Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Save as PDF Button versions = 1.9.2...

WordPress plugin Save as PDF Button 跨站脚本漏洞

The WordPress Save as PDF Button plugin is a tool that adds one-click PDF generation functionality to WordPress websites, allowing visitors to save web content e.g., articles, product pages, etc. as PDF files with the click of a button. WordPress Save as PDF Button plugin has a cross-site scripti...

PT-2025-46794

Name of the Vulnerable Software and Affected Versions Save as PDF Button plugin for WordPress versions prior to 1.9.3 Description The software has a flaw due to insufficient input sanitization and output escaping on user-supplied attributes within the restpackpdfbutton shortcode. This allows...

How Trellix Helix detects AS-REP Roasting in Active Directory

How Trellix Helix detects AS-REP Roasting in Active Directory By Adithya Chandra and Maulik Maheta · November 13, 2025 Executive Summary Adversaries use AS-REP Roasting to extract and crack password hashes from Active Directory AD accounts with Kerberos preauthentication disabled, a...

EUVD-2025-134768

Malicious code in anais-paoa-as npm...

EUVD-2025-134767

Malicious code in anais-paoa-as npm...

EUVD-2025-139407

Malicious code in nuilva-vmiam-as npm...

Malicious code in nuilva-vmiam-as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0d499c027cc9cd1af799247a6980bcb608b3d0f24e7598dda2646314453d6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avminh-as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e672b6d1618a2ec87196da5c5d587d193785daa40ded05cd319a4598ebbea74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jurss-zsa-as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f159ab5bded9a2970ede5336f9b2b4e2054c4f5806fcf2ffae8fc1c1d9faefc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jurss-zsaa-as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8006fb94fb09742b16d98090fdd74f710194765beb60da725ccddf32f2b93f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jurss-sdbd-as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d0b6475a1df2b6d9d769ce3d9aa2448c3d0acead223d5927a5b5db1d78f345 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jurss-dsf-as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b177587ee9a76ddda2d7b68b5fbc3bd94de5d4a572ad4d923f1a9bde9cc75f6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155363 Malicious code in guras-as-koreaselatan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bff23c4923a1bfff5b41882c76dfe0e6fb00adbedca20f8dd763a03e13dcd84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: exfat: fix out-of-bounds access of directory entries

In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if startclu becomes an EOF clusteran invalid cluster due to file system corruption, then the...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issue: Mozilla Thunderbird is updated to 140.4. changed: Account Hub is now disabled by default for second email account bmo1992027 changed: Flatpak runtime has been updated to Freedesktop SDK 24.08 bmo1952100 fixed: Users could not read mail...

EUVD-2025-44037

Malicious code in chai-as-sorted npm...

Malicious code in chai-as-sorted (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0a3502254657767ec819133929d33c2b84f1d9607acc89e9557de2b80e9bed The package chai-as-sorted was found to contain malicious code. Source: ghsa-malware 0a769064bb46785af26b5ee4af98633de26f88bcad7b199c113bdf52940e195a...