CVE-2025-53249 WordPress Build App Online Plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through = 1.0.23...

CVE-2025-53249

CVE-2025-53249 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Build App Online (hakeemnala Build App Online). Affected versions are up to 1.0.23; the issue enables CSRF on authenticated actions. Public sources consistently indicate remediation by upgrading to ...

CVE-2025-53581

CVE-2025-53581 is a stored XSS vulnerability in the artiosmedia RSS Feed Pro WordPress plugin (versions up to 1.1.8). The root cause is improper input neutralization during web page generation, allowing stored JavaScript in the feed output. Impact: low to moderate per CVSS 3.1 metrics (base score...

WordPress Build App Online Plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by theviper17 in WordPress Plugin Build App Online versions = 1.0.23...

Malicious code in @angular_devkit/build-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 053dbd5b72c824b5644482986fcc9a5caca48fcbe447f90f957e420418f2bcb4 The OpenSSF Package Analysis project identified '@angulardevkit/build-webpack' @ 99.1.1 npm as malicious. It is considered malicious because: -...

SUSE CVE-2025-55160

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior function-type-mismatch in splay tree cloning callback. This results in a deterministic abort under UBSan DoS in sanitizer builds, wit...

PT-2025-33370 · Unknown · Hakeemnala Build App Online

Name of the Vulnerable Software and Affected Versions: hakeemnala Build App Online versions n/a through 1.0.23 Description: A Cross-Site Request Forgery CSRF issue exists in hakeemnala Build App Online, potentially allowing attackers to perform actions on behalf of authenticated users...

WordPress plugin Build App Online 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress plugin Build App Online 1.0.23 and prior...

CVE-2025-53249: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through = 1.0.23...

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

CVE-2025-8760

A vulnerability was identified in INSTAR 2K+ and 4K 3.11.1 Build 1124. This affects the function base64decode of the component fcgiserver. The manipulation of the argument Authorization leads to buffer overflow. It is possible to initiate the attack remotely...

CVE-2025-8761 INSTAR 2K+/4K Backend IPC Server denial of service

A vulnerability has been found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This vulnerability affects unknown code of the component Backend IPC Server. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-8761 INSTAR 2K+/4K Backend IPC Server denial of service

A vulnerability has been found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This vulnerability affects unknown code of the component Backend IPC Server. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-8762

CVE-2025-8762 affects INSTAR 2K+ and 4K devices running version 3.11.1 Build 1124, specifically the UART Interface component. The issue arises from improper physical access control, enabling potential attacks on the physical device. Public disclosure of the exploit is noted. Available documents d...

CVE-2025-8762 INSTAR 2K+/4K UART improper physical access control

A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack on the physical device. The exploit has been disclosed to t...

PT-2025-32970 · Dinstar · Instar 4K +1

Name of the Vulnerable Software and Affected Versions: INSTAR 2K+ and 4K version 3.11.1 Build 1124 Description: A vulnerability exists in the UART Interface component of the software, leading to improper physical access control. This allows for potential attacks directly on the physical device. T...

CVE-2025-8762: Improper Physical Access Control

A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack on the physical device. The exploit has been disclosed to t...

PT-2025-32969 · Dinstar · Instar 2K+ +1

Name of the Vulnerable Software and Affected Versions: INSTAR 2K+ and 4K version 3.11.1 Build 1124 Description: A vulnerability exists in the Backend IPC Server component that can lead to a denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed...

SUSE CVE-2025-7195

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, usersetup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used...

CVE-2025-54800

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...