Combating Reentrancy Bugs on Sharded Blockchains

Reentrancy is a well-known source of smart contract bugs on Ethereum, leading e.g. to double-spending vulnerabilities in DeFi applications. But less is known about this problem in other blockchains, which can have significantly different execution models. Sharded blockchains in particular general...

PT-2025-24089 · Cyberchimps · Cyberchimps Responsive Plus

Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Plus versions 3.2.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...

WordPress plugin Activity Plus Reloaded for BuddyPress 安全漏洞

WordPress Activity Plus Reloaded for BuddyPress plugin is an extension plugin that provides additional functionality to the BuddyPress community plugin. WordPress Activity Plus Reloaded for BuddyPress plugin suffers from an authorization issue vulnerability that stems from a lack of authorization...

CVE-2025-30990: Missing Authorization

Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through = 1.2.0...

PT-2025-24094 · Unknown · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 6.2.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

CVE-2025-30957: Missing Authorization

Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through = 1.1.2...

CVE-2025-49076: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a...

CVE-2025-48335: Missing Authorization

Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through = 3.2.0...

WordPress plugin Responsive Plus 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin The Plus Addons for Elementor Page Builder Lite 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin The Plus...

PT-2025-24178 · Buddydev · Buddydev Activity Plus Reloaded

Name of the Vulnerable Software and Affected Versions: BuddyDev Activity Plus Reloaded for BuddyPress versions 1.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

CVE-2025-5672

A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument url leads to buffer...

CVE-2025-5672

A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument url leads to buffer...

CVE-2025-5671

A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype leads to buffer overflow. It is possib...

CVE-2025-5672 TOTOLINK N302R Plus HTTP POST Request formFilter buffer overflow

A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument url leads to buffer...

CVE-2025-5672

The CVE-2025-5672 entry concerns TOTOLINK N302R Plus (versions up to 3.4.0-B20201028). The vulnerability exists in the HTTP POST Request Handler’s file /boafrm/formFilter, where manipulation of the url argument causes a buffer overflow. It can be triggered remotely, with public disclosure of the ...

CVE-2025-5672 TOTOLINK N302R Plus HTTP POST Request formFilter buffer overflow

A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument url leads to buffer...

CVE-2025-5671 TOTOLINK N302R Plus HTTP POST Request formPortFw buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype leads to buffer overflow. It is possib...

CVE-2025-5671

TOTOLINK N302R Plus firmware ≤ 3.4.0-B20201028 has a buffer overflow in the HTTP POST Request Handler function /boafrm/formPortFw caused by manipulation of the service_type argument. The issue enables remote code execution, with exploits disclosed publicly. Multiple sources corroborate a critical...

CVE-2025-5671 TOTOLINK N302R Plus HTTP POST Request formPortFw buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype leads to buffer overflow. It is possib...