PT-2025-46782

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.11.25 Description The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the usces export action...

CVE-2025-52186

The Lichess lila chess server is vulnerable to a Server-Side Request Forgery (SSRF) in the game export API before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02). The root cause is the unvalidated direct passing of the players parameter to an internal HTTP client. This allows remote ...

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

WordPress plugin Welcart e-Commerce 安全漏洞

WordPress Welcart e-Commerce Plugin is an e-commerce plugin designed for WordPress to build and manage online stores. WordPress Welcart e-Commerce Plugin suffers from an unauthorized access vulnerability that stems from a lack of capability checking in the uscesexport operation, which can be...

PT-2025-46815

Name of the Vulnerable Software and Affected Versions WebToffee Order Export & Order Import for WooCommerce versions through 2.6.7 Description The software contains a flaw related to incorrectly configured access control, allowing for unauthorized access. The issue impacts the Order Export & Orde...

WordPress plugin Order Export & Order Import for WooCommerce 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CVE-2025-64382: Missing Authorization

Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Export & Order Import for WooCommerce: from n/a through = 2.6.7...

PT-2025-46842

🚨 CVE-2025-52186 Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to...

lila 安全漏洞

lila is an ad-free and open source chess server from Lichess Open Source. A security vulnerability exists in lila, which stems from the unvalidated direct passing of the players parameter in the game export API, which could lead to server-side request forgery...

CVE-2025-52186: Server-Side Request Forgery (SSRF)

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

CVE-2025-64167

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2025-33202 via nvidia-pytriton (0.7.0)

nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.7.1 Source cves: CVE-2025-33202 Source advisory:...

kernel: nfsd: release svc_expkey/svc_export with rcu_work

A flaw was found in the Linux kernel's Network File System daemon nfsd. A local user can trigger a use-after-free condition when export cache entries are prematurely released during read operations. This issue may lead to memory corruption, potentially causing a system crash and resulting in a...

The vulnerability of the export function of the SuiteCRM system’s client relationship management module allows a hacker to execute arbitrary code.

The vulnerability of the export function of the SuiteCRM system’s client relationship management module is related to the lack of measures taken to protect the SQL query structure when processing the uid parameter. Exploiting this vulnerability allows an attacker operating remotely to execute...

CVE-2025-64167 Combodo iTop vulnerable to reflected XSS in webservices/export.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

CVE-2025-64167 Combodo iTop vulnerable to reflected XSS in webservices/export.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

CVE-2025-64167

Combodo iTop, a web-based IT service management tool, is vulnerable to cross-site scripting (JS execution) in versions prior to 2.7.13 and 3.2.2 when editing a URL parameter. In these versions, the export.php endpoint was deprecated and export-v2.php is used instead; the issue stems from insuffic...

EUVD-2025-50821

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

CVE-2025-64167 Combodo iTop vulnerable to reflected XSS in webservices/export.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...