PT-2025-44950

The Import Export For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update setting function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access...

PT-2025-44947

The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp ajax nopriv dominokit option admin action AJAX endpoint in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update plugin settings...

CVE-2025-12600

Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-8900 Doccure Core < 1.5.4 - Unauthenticated Privilege Escalation

The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'usertype' field. This makes it possible for unauthenticated attacke...

CVE-2025-12600 Web UI Malfunction

Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12600

CVE-2025-12600 affects Azure Access Technology BLU-IC2 and BLU-IC4 (through 1.19.5). Reports describe a Web UI malfunction when an unexpected locale is set via an API call. The vulnerability impacts the Web UI layer and is tied to the locale parameter supplied through the API, with affected versi...

CVE-2025-12600 Web UI Malfunction

Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquiring references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf that backs the buffer object, if an...

EUVD-2025-37411

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-63458

Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the formfastsettingwifiset function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

PT-2025-44727

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description A malfunction exists in the Web UI when an unexpected locale is set via an API. The issue involves setting a locale through an API call, which leads to a Web UI...

Tenda CH22 fromNatStaticSetting function buffer overflow vulnerability

Tenda CH22 is a network device from Tenda, China. Tenda CH22 version 1.0.0.1 suffers from a buffer overflow vulnerability, which originates from the parameter page of the function fromNatStaticSetting in the file /goform/NatStaticSetting that fails to correctly validate the length of the input...

CVE-2025-63458

The Tenda AX-1803 wireless router (version 1.0.0.1 ) is vulnerable to a stack-based buffer overflow within the form_fast_setting_wifi_set function. The root cause is a failure to correctly validate the length of input data provided via the timeZone parameter. An attacker can exploit this by sendi...

CVE-2025-63458

Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the formfastsettingwifiset function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

PT-2025-44669

Name of the Vulnerable Software and Affected Versions Tenda AX-1803 version 1.0.0.1 Description The Tenda AX-1803 router contains a stack overflow issue through the timeZone parameter within the form fast setting wifi set function. A crafted request can lead to a Denial of Service DoS. The...

Tenda AX-1803 安全漏洞

The Tenda AX-1803 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in the Tenda AX-1803 v1.0.0.1, which originates from the timeZone parameter in the formfastsettingwifiset function that fails to correctly validate the length of the input data, and can be...

GO-2025-4056 Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...

PT-2025-45856

Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...

TypeORM 安全漏洞

TypeORM is an excellent Node.js ORM framework open-sourced by TypeORM. The goal of the software is to maintain support for the latest Javascript features; with the following features: 1 provide one-to-one, many-to-one, one-to-many, many-to-many relational processing of tables; 2 to help develop a...

CVE-2025-12269

A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/settings/previews of the component Account Setting Page. The manipulation results in cross site scripting. It is possible to launch the attack...