[SECURITY] [DSA 5920-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5920-1 [email protected] https://www.debian.org/security/ Andres Salomon May 15, 2025 https://www.debian.org/security/faq -...

GHSA-7MM3-VFG8-7RG6 Babylon Finality Provider `MsgCommitPubRandList` replay attack

Summary A high vulnerability exists in the Babylon protocol's x/finality module due to a lack of domain separation in signed messages, combined with insufficient validation in the MsgCommitPubRandList handler. Specifically, the handler does not enforce that the submitted Commitment field is 32...

PT-2025-21349 · WordPress · Wp2Leads

Name of the Vulnerable Software and Affected Versions: WP2LEADS versions 3.5.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially...

PT-2025-21533 · WordPress · Database Backup

Name of the Vulnerable Software and Affected Versions: Backup Database WordPress plugin versions prior to 4.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

PT-2025-21510 · WordPress · Widgets Reset

Name of the Vulnerable Software and Affected Versions: Widgets Reset WordPress plugin versions 0.1 and earlier Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21575 · Auth0 · Auth0/Wordpress +3

Name of the Vulnerable Software and Affected Versions: Auth0-PHP versions 8.0.0-BETA1 through 8.13.x Description: The issue affects applications using the Auth0-PHP SDK configured with CookieStore, where session cookies have authentication tags that can be brute forced, potentially resulting in...

PT-2025-21289 · Sourcecodester · Sourcecodester Best Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version V1.0 Description: The issue concerns a Cross Site Request Forgery CSRF in the /admin/change pass.php endpoint via the password parameter. This allows for potential unauthorized password...

PT-2025-21433 · WordPress · Clasify Classified Listing Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Clasify Classified Listing WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted...

PT-2025-21341 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue affects the processing of the file "/pages/transaction add.php". The manipulation of the prod name argument leads to SQL injection. The attack may be initiated...

PT-2025-21567 · Unknown · Phpgurukul Company Visitor Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Company Visitor Management System version 2.0 Description: A critical issue was found in the PHPGurukul Company Visitor Management System, affecting an unknown function of the file /visitors-form.php. The manipulation of the fullna...

PT-2025-21582 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue has been discovered, affecting the /view student.php file, where manipulation of the ID argument leads to SQL injection. This can be initiated remotely...

PT-2025-21430 · WordPress · Simple Basic Contact Form

Name of the Vulnerable Software and Affected Versions: The Simple Basic Contact Form WordPress plugin versions prior to 20250114 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21454 · WordPress · Calculated Fields Form

Name of the Vulnerable Software and Affected Versions: Calculated Fields Form WordPress plugin versions prior to 5.2.64 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21516 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions prior to 1.0.1 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in administrator change them via a CSRF attack. This could potentially permit...

PT-2025-21379 · WordPress · Abitgone Commentsafe

Name of the Vulnerable Software and Affected Versions: aBitGone CommentSafe WordPress plugin versions 1.0.0 and earlier Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add...

PT-2025-21368 · Atheros · Atheos

Name of the Vulnerable Software and Affected Versions: Atheos versions prior to v602 Description: Atheos is a self-hosted browser-based cloud IDE. The $target parameter in "/controller.php" was not properly validated, which could allow an attacker to execute arbitrary files on the server via path...

PT-2025-21284 · Unknown · Phpgurukul Vehicle Record Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Vehicle Record Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS problem. It affects the /admin/profile.php endpoint through the name, email, and mobile parameters. Recommendations: For...

PT-2025-21570 · Dumb Drop · Dumb Drop

Name of the Vulnerable Software and Affected Versions: DumbDrop versions prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b Description: The issue is related to a DOM cross-site scripting vulnerability in the upload functionality. A user could be tricked into uploading a file with a malicio...

PT-2025-21576

Name of the Vulnerable Software and Affected Versions: Tornado versions prior to 6.5.0 Description: The issue allows remote attackers to generate a high volume of logs, constituting a denial-of-service DoS attack, by exploiting Tornado's multipart/form-data parser when it encounters certain error...

PT-2025-21544 · WordPress · Popup Box

Name of the Vulnerable Software and Affected Versions: The Popup Box WordPress plugin versions prior to 4.7.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...