WordPress BuddyBoss Platform plugin <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'bpnouveauajaxmediasave' function vulnerability discovered by Kaique Peres in WordPress Plugin Buddyboss Platform versions = 2.8.50...

iiCMS 代码注入漏洞

iCMS is a software application. It is an efficient and simple content management system built with PHP and MySQL. A code injection vulnerability exists in iCMS 8.0.0 and earlier versions, which stems from an incorrect operation of the parameter config by the Save function in the POST Parameter...

PT-2026-4667

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.19.0-rc2-ffa07f7fd437-x86 amx nm xfd non init-vm Description The Linux kernel contains a flaw related to the handling of XSTATE BV and XFD during guest XSAVE state loading via KVM SET XSAVE. Specifically, the...

CVE-2025-15356

A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit...

EUVD-2025-205852

A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit...

CVE-2025-15356

The vulnerability CVE-2025-15356 affects Tenda AC20 routers (firmware up to 16.03.08.12). The issue is in the sscanf call in /goform/PowerSaveSet, where improper handling of the arguments powerSavingEn, time, powerSaveDelay, and ledCloseType can lead to a buffer overflow. Remote exploitation is p...

CVE-2025-15356 Tenda AC20 PowerSaveSet sscanf buffer overflow

A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit...

CVE-2022-50863

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: free unused skb to prevent memory leak This avoid potential memory leak under power saving mode...

CVE-2025-15214

A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function savepricing of the file adminclass.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote. The exploit has been made public and...

CVE-2025-15214

CVE-2025-15214 affects Campcodes Park Ticketing System 1.0. The vulnerable component is the save_pricing function in admin_class.php, where manipulating the Name/ride argument enables cross-site scripting. The issue is exploitable remotely and exploitation has been publicly disclosed. Multiple so...

CVE-2025-15214 Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting

A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function savepricing of the file adminclass.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote. The exploit has been made public and...

EUVD-2025-205676

A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function savepricing of the file adminclass.php. The manipulation of the argument Name results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could...

CVE-2025-15214 Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting

A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function savepricing of the file adminclass.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote. The exploit has been made public and...

CVE-2024-25181

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery SSRF and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "filegetcontents" function within the "save.php" file...

PT-2025-53833

Name of the Vulnerable Software and Affected Versions Campcodes Park Ticketing System version 1.0 Description A security issue exists in Campcodes Park Ticketing System version 1.0. The save pricing function within the admin class.php file is susceptible to cross-site scripting XSS due to...

CVE-2025-66203

StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution RCE vulnerability exists in the stream-vault application SpiritApplication. The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without...

PT-2025-53789

Name of the Vulnerable Software and Affected Versions givanz VvvebJs version 1.7.2 Description givanz VvvebJs version 1.7.2 is subject to a File Upload issue through the save.php file. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2024-25182

Affected software: givanz VvvebJs 1.7.2. The CVE describes a file upload vulnerability via save.php, with a CVSS v3.1 base score of 9.8 (CRITICAL), attack vector NETWORK, no user interaction, and impact to confidentiality, integrity, and availability (H, H, H). Root cause is a file upload flaw in...

CVE-2024-25181

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery SSRF and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "filegetcontents" function within the "save.php" file...

CVE-2024-25181

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery SSRF and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "filegetcontents" function within the "save.php" file...