PT-2025-39485

Name of the Vulnerable Software and Affected Versions ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution versions prior to 4.8.4 Description The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is susceptible to unauthorized access. This is due to ...

CVE-2025-55848

CVE-2025-55848 affects the DIR-823 family (firmware 20250416). Root cause: the set_cassword/settings interface does not properly filter the http_casswd parameter, enabling code execution via injection of reverse-connection commands. Impact stated across sources is remote code execution with high ...

CVE-2025-55847

Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...

PT-2025-39661

Name of the Vulnerable Software and Affected Versions DIR-823 firmware version 20250416 Description A remote code execution issue exists in the set cassword settings interface. The http casswd parameter does not properly filter the '&' character, allowing for the injection of reverse connection...

CVE-2025-55847

The CVE-2025-55847 entry concerns Wavlink M86X3A_V240730. The vulnerability is a buffer overflow in the /cgi-bin/ExportAllSettings.cgi endpoint caused by improper validation of the length of data passed via the Cookie parameter. The issue can allow attackers to execute arbitrary code or cause a d...

Wavlink M86X3A_V240730 安全漏洞

Wavlink M86X3AV240730 is a device firmware from China Ruiyin Wavlink. A security vulnerability exists in Wavlink M86X3AV240730, which originates from a cookie parameter in the /cgi-bin/ExportAllSettings.cgi file that does not correctly validate the length of the input data, which could result in...

PT-2025-39670

Name of the Vulnerable Software and Affected Versions Wavlink M86X3A V240730 affected versions not specified Description The software contains a buffer overflow issue in the /cgi-bin/ExportAllSettings.cgi file. The problem is due to insufficient validation of the length of input data received...

CVE-2025-36857

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom...

LinkedIn will use your data to train its AI unless you opt out now

LinkedIn plans to share user data with Microsoft and its affiliates for AI training. Framed as "legitimate interest", it won't ask for your permission—instead you'll have to opt out before the deadline. Microsoft has made major investments in ChatGPT’s creator OpenAI, and as we know, the more dat...

Applying Custom Settings to Veeam Software Appliance

Purpose This article documents the configuration files on the Veeam Software Appliance that correspond to registry locations in Windows used for custom settings in Veeam Backup & Replication. Custom registry-based settings for Veeam Backup & Replication on Windows can also be applied to the Veeam...

CVE-2025-9054

CVE-2025-9054 affects the MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress. The issue is unauthorized modification of data due to a missing capability check in the wcmlim_settings_ajax_handler, impacting all versions up to 4.2.8. This allows unauthenticated attack...

CVE-2025-9054 MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlimsettingsajaxhandler' function in all versions up to, and including, 4.2.8...

WordPress Advanced Settings Plugin <= 3.1.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by R1sky in WordPress Plugin Advanced Settings versions = 3.1.1...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC,...

CVE-2025-57432

Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication...

Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110

This module allows you to use different currencies on your website and do currency conversion. The module doesn't sufficiently protect routes used to enable and disable currencies from Cross-Site Request Forgery CSRF attacks, potentially allowing an attacker to trick an admin into changing settin...

WordPress plugin MultiLoca - WooCommerce Multi Locations Inventory Management 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:16487)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16487 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

AutomationDirect CLICK PLUS

RISK EVALUATION Successful exploitation of these vulnerabilities disclose sensitive information, modify device settings, escalate privileges, or cause a denial-of-service condition on the affected device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk...

kernel: do_change_type(): refuse to operate on unmounted/not ours mounts

In the Linux kernel, the following vulnerability has been resolved: dochangetype: refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount2...