CVE-2025-7690

CVE-2025-7690 affects the WordPress Affiliate Plus plugin up to version 1.3.2, with a Cross-Site Request Forgery vulnerability caused by missing/incorrect nonce validation on the affiplus_settings page. This can allow unauthenticated attackers to trigger actions on behalf of an administrator if t...

PT-2025-30654 · WordPress · Affiliate Plus

Name of the Vulnerable Software and Affected Versions: Affiliate Plus plugin for WordPress versions up to and including 1.3.2 Description: The Affiliate Plus plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the affiplus settings pag...

WordPress plugin Affiliate Plus 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress Affiliate Plus, which stems from missing or incorrect random number validation, and can be exploited by an...

CVE-2025-7690: Cross-Site Request Forgery (CSRF)

The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'affiplussettings' page. This makes it possible for unauthenticated attackers to perform an unauthorized...

CVE-2025-5818

CVE-2025-5818 affects the WordPress plugin Featured Image Plus – Quick & Bulk Edit with Unsplash. Technical details in connected docs confirm an authenticated SSRF in fip_get_image_options() impacting all versions up to 1.6.4 (Wordfence/NVD). Exploitation requires administrator-level access or hi...

CVE-2025-5818 Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

PT-2025-30511 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: Featured Image Plus – Quick & Bulk Edit with Unsplash versions prior to 1.6.4 Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to Server-Side Request Forgery via the fip get image...

WordPress plugin Featured Image Plus – Quick & Bulk Edit with Unsplash 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Featured Image Plu...

CVE-2025-5818: Server-Side Request Forgery (SSRF)

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

FaultLine: Automated Proof-Of-Vulnerability Generation Using LLM Agents

Despite the critical threat posed by software security vulnerabilities, reports are often incomplete, lacking the proof-of-vulnerability PoV tests needed to validate fixes and prevent regressions. These tests are crucial not only for ensuring patches work, but also for helping developers understa...

Kintsugi: Decentralized E2EE Key Recovery

Kintsugi is a protocol for key recovery, allowing a user to regain access to end-to-end encrypted data after they have lost their device, but still have their potentially low-entropy password. Existing E2EE key recovery methods, such as those deployed by Signal and WhatsApp, centralize trust by...

NVIDIA DOCA-Host和NVIDIA Mellanox OFED 安全漏洞

NVIDIA DOCA-Host and NVIDIA Mellanox OFED are both products of NVIDIA Corporation, U.S.A. NVIDIA DOCA-Host is a software package for host servers.NVIDIA Mellanox OFED is an Enhanced Networking Driver Box Stack Suite. A security vulnerability exists in NVIDIA DOCA-Host and NVIDIA Mellanox OFED tha...

Avid多款产品 安全漏洞

Avid NEXIS E-series, among others, is a virtualized storage platform from Avid, USA. A security vulnerability exists in various Avid products that stems from the use of a vulnerable version of gSOAP, which could lead to an unauthenticated path traversal attack. The following products and versions...

CVE-2020-36848: Exposure of Sensitive Information to an Unauthorized Actor

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to...

SpringBoot_MyBatisPlus 路径遍历漏洞

SpringBootMyBatisPlus is a SpringBoot integration with MyBatisPlus by Siwei Zhou, an individual developer. A path traversal vulnerability exists in SpringBootMyBatisPlus, which stems from path traversal due to incorrect manipulation of the parameter Name in file/file/download...

UBUNTU-CVE-2025-53630

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the ggufinitfromfileimpl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579...

HPESBHF04785 rev.1 - Certain HPE SimpliVity AMD Servers Using Certain AMD EPYC Processors, AMD-SB-3019: AMD SEV Confidential Computing Vulnerability

Potential Security Impact: Local: Unauthorized Data Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SimpliVity 325 Gen10 Plus - Prior to HPE SimpliVity Gen10 Support Pack SVTSP v20250630 HPE SimpliVity 325 Gen10 - Prior to HPE SimpliVity Gen10 Support Pack SVTSP v202506...

HPESBHF04897 rev.1 - Certain HPE SimpliVity Servers Using Certain AMD EPYC Processors, AMD-SB-7039: Unauthorized Access to AMD Secure Processor’s Crypto-Co-Processor, Local Unauthorized Access Vulnerability

Potential Security Impact: Local: Unauthorized Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SimpliVity 325 Gen10 Plus - Prior to HPE SimpliVity Gen10 Support Pack SVTSPGen10 v20241129 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2023-2059...

HPESBHF04798 rev.1 - Certain HPE SimpliVity Servers using AMD 3rd Generation and 4th Generation EPYC Processors, AMD-SB-3015, Undermining Integrity Features of SEV-SNP with Memory Aliasing (BadRAM)

Potential Security Impact: Local: Compromise of System Integrity SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SimpliVity 325 Gen10 Plus - Prior to HPE SimpliVity Gen10 Support Pack SVTSPGen10 v2025-0630 HPE SimpliVity 325 Gen11 - Prior to HPE SimpliVity Gen11 Support Pack...

CVE-2025-7079

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...