1105 matches found
CVE-2025-48306 WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects Savyour Affiliate Partner: from n/a through = 2.1.4...
CVE-2025-48306
CVE-2025-48306 describes a CSRF to Stored XSS vulnerability in the WordPress plugin Savyour Affiliate Partner (versions up to 2.1.4). The CVSS 3.1 base score is 7.1 (High); attack vector is NETWORK with LOW attack complexity, NONE privileges, user interaction required, and within a changed scope,...
CVE-2025-48306 WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects Savyour Affiliate Partner: from n/a through = 2.1.4...
WordPress plugin Savyour Affiliate Partner 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
PT-2025-34995
Name of the Vulnerable Software and Affected Versions: Savyour Affiliate Partner versions through 2.1.4 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Savyour Affiliate Partner, which also allows Stored Cross-Site Scripting XSS. Recommendations: Update Savyour Affiliate...
WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Savyour Affiliate Partner versions = 2.1.4...
Linux Distros Unpatched Vulnerability : CVE-2025-37986
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Invalidate USB device pointers on partner unregistration To avoid using...
Bykea: Customer can cancel a individual booking in a batch, causing locking of partner.
The vulnerability allowed users to update the status of individual trips inside a batch, even though only batch-level status changes were intended. By cancelling the single trip inside a one-parcel batch, the batch was placed into an inconsistent state, causing the assigned partner to become stuc...
Linux Distros Unpatched Vulnerability : CVE-2025-37809
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Fix NULL pointer access Concurrent calls to typecpartnerunlinkdevice can...
Linux Distros Unpatched Vulnerability : CVE-2025-37994
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsidisplayportwork workqueue ...
kernel: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpmpdsvdm It is possible that typecregisterpartner returns ERRPTR on failure. When port-partner is an error, a NULL pointer dereference may occur as shown below. 91222.095236 T31...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to FreeType Remote Code Execution Vulnerability (CVE-2025-27363)
Summary IBM Sterling Partner Engagement Manager uses FreeType has part of the package and is affected by CVE-2025-27363 for versions 2.13.0 and below. Vulnerability Details CVEID:CVE-2025-27363 DESCRIPTION: An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of...
CVE-2025-6077
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...
CVE-2025-6078
Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note...
CVE-2025-6077
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...
CVE-2025-6078
CVE-2025-6078 affects Partner Software’s Partner Software and Partner Web applications. An authenticated user can submit notes on the Notes page in a job view, and input is not fully sanitized, allowing HTML/JavaScript in notes and resulting in stored XSS. Public details from multiple sources con...
CVE-2025-6078 CVE-2025-6078
Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note...
CVE-2025-6077
CVE-2025-6077 concerns Partner Software’s Partner Software Product and Partner Web application, where the administrator account uses the same default username and password across all versions. Multiple sources confirm the issue can enable unauthorized admin access and, per CERT/industry notes, ma...
CVE-2025-6077 CVE-2025-6077
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...