CVE-2025-21849

CVE-2025-21849: Linux kernel drm/i915/gt had potential deadlocks due to spin_lock/unlock() used in interrupt contexts. The fix saves irq state before acquiring locks. Version history shows v2 adds irq state save/restore around signal_irq_work locks; v3 uses spin_lock_irqsave() in guc_lrc_desc_unp...

CVE-2025-1926

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayersavepost function. This makes it possible for...

[SECURITY] Fedora 41 Update: buildah-1.39.2-1.fc41

The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...

tianti 跨站请求伪造漏洞

tianti tianti is a JAVA lightweight CMS solution by jeffry personal developer. A security vulnerability exists in tianti v2.3, which stems from a cross-site request forgery vulnerability in the /user/ajax/save component that could lead to the execution of arbitrary operations...

WordPress plugin Page Builder: Pagelayer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Page Builder: A...

CVE-2025-25908

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

PT-2025-10639

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue allows attackers to execute arbitrary operations via a crafted GET or POST request to the /user/ajax/save API endpoint. This is due to a Cross-Site Request Forgery CSRF vulnerability. Recommendations Fo...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25908: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

CVE-2025-25907: Cross-Site Request Forgery (CSRF)

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2024-10326

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveoptions and resetwidgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...

CVE-2024-11640

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change...

CVE-2024-13908

The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

WordPress RomethemeKit For Elementor plugin <= 1.5.3 - Missing Authorization in save_options and reset_widgets vulnerability

Missing Authorization in saveoptions and resetwidgets vulnerability discovered by WordFence in WordPress Plugin RTMKit versions = 1.5.3...

PT-2025-10415

Name of the Vulnerable Software and Affected Versions The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress versions up to, and including, 3.1.7 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save to...

PT-2025-10424

Name of the Vulnerable Software and Affected Versions SMTP by BestWebSoft plugin for WordPress versions up to 1.1.9 Description The issue arises from missing file type validation in the save options function, allowing authenticated attackers with Administrator-level access and above to upload...

PT-2025-10408

Name of the Vulnerable Software and Affected Versions FooGallery – Responsive Photo Gallery plugin versions prior to 2.4.30 Description The issue allows authenticated attackers with granted access and above to update arbitrary post and page content due to missing validation on a user-controlled k...

CVE-2025-2085

A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The manipulation of the argument redirectUrl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

OESA-2025-1258 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file wi...

PT-2025-10049

Name of the Vulnerable Software and Affected Versions UiPress lite versions up to, and including, 3.5.04 Description The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the uip save form as option function. This...