8542 matches found
WordPress Shopper plugin <= 3.2.5 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Anhchangmutrang in WordPress Plugin Shopper versions = 3.2.5...
WordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Phat RiO - Fore-Z co.ltd in WordPress Plugin Vitepos versions = 3.1.4...
WordPress Real Estate 7 Theme <= 3.5.4 is vulnerable to Arbitrary File Upload
Software Real Estate 7 Type Theme Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-2891 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 22e03f3e7c10 Credits Foxyyy Required privilege Seller...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.5.1 release.
Red Hat Developer Hub 1.5.1 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
CVE-2025-30531
Cross-Site Request Forgery CSRF vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through = 2.4...
Vite bypasses server.fs.deny when using ?raw??
Summary The contents of arbitrary files can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Details @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or...
CVE-2025-30531 WordPress WP Ride Booking plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through = 2.4...
CVE-2025-30531
CVE-2025-30531: CSRF in WP Ride Booking (wp-ride-booking) plugin observed up to version 2.4. Provided sources list a CSRF risk with Network attack vector, requiring user interaction, and a Medium impact rating (I=Low, A=None). No evidence of an available fix or patched version is included in the...
CVE-2025-30531: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through = 2.4...
Critical GitHub Attack
This is serious: A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have...
LLaVA 资源管理错误漏洞
LLaVA is an application by Haotian Liu, an individual developer. A resource management error vulnerability exists in LLaVA v1.2.0, which stems from a file upload request being mishandled, which could lead to a denial of service...
A Bootiful Podcast: Java Champion and legend Henri Tremblay
Hi, Spring fans! In this installment I talk to Henri Tremblay, head of TS Imagine Canada, Java Champion, Montreal JUG leader, EasyMock lead dev and all around legend!...
Morning 安全漏洞
Morning is a public service online e-commerce store by the individual developer of Morning in China. A security vulnerability exists in Morning bc782730c74ff080494f145cc363a0b4f43f7d3e and prior versions, which stems from vulnerability to cross-site request forgery attacks...
[SECURITY] Fedora 42 Update: python-jinja2-3.1.6-1.fc42
Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...
Lazarus Group Hid Backdoor in Fake npm Packages in Latest Attack
Lazarus Group targets developers with malicious npm packages, stealing credentials, crypto, and installing backdoor. Stay alert to protect your projects...
KLA81542 Multiple vulnerabilities in Microsoft Developer Tools
Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Type confusion vulnerability in .N...
Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist
SafeWallet has revealed that the cybersecurity incident that led to the Bybit $1.5 billion crypto heist is a "highly sophisticated, state-sponsored attack," stating the North Korean threat actors behind the hack took steps to erase traces of the malicious activity in an effort to hamper...
Linux Distros Unpatched Vulnerability : CVE-2024-29180
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently...
CVE-2025-1424 Privilege Escalation Through SUID Binary and Developer Mode
A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. This issue affects InkPad Color 3 in version U743k3.6.8.3671...
