CVE-2025-4580 File Provider <= 1.2.3 - Item Deletion via CSRF

The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2025-4580

CVE-2025-4580 affects the WordPress File Provider plugin (versions

PT-2025-23855 · Freshrss · Freshrss

Name of the Vulnerable Software and Affected Versions: FreshRSS versions prior to 1.26.2 Description: The issue allows an attacker to poison feed favicons by manipulating the feed URL and proxy settings, potentially replacing favicons for all users. This is possible because the favicon hash...

PT-2025-23761 · WordPress · Filterprovider

Name of the Vulnerable Software and Affected Versions: File Provider versions 1.2.3 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via ...

CVE-2025-3584

The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-53016

Memory corruption while processing I2C settings in Camera driver...

CVE-2024-53016 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while processing I2C settings in Camera driver...

CVE-2024-53016

CVE-2024-53016 affects Qualcomm platforms with a camera driver; memory corruption occurs while processing I2C camera settings. Several connected sources describe a TOCTOU race condition as the underlying root cause, leading to potential instability or corruption locally (attack surface not detail...

CVE-2024-53016 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while processing I2C settings in Camera driver...

SUSE CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient permission checks when changing team privacy settings, allowing unauthorized team administrators to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy...

Netscaler-13.1-Security scanner reported "Cacheable SSL Page Found" for gateway virtual server

Security scanner reported "Cacheable SSL Page Found" for gateway virtual server. The detailed content reported by the scanner is as below: ------------------------------ The application has responded with a response that indicates the page should be cached, but cache controls aren't set you can...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm, Inc. A security vulnerability exists in Qualcomm Chipsets that stems from a possible memory corruption when processing camera driver I2C settings...

CVE-2025-43924

Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController for /fp/admin/settings/loginpage and the rootserviceurl parameter in FriendsController for /fp/admin/settings/friends, entered by an admin, allow stored XSS...

Cisco Meraki Settings

This plugin configures the Cisco Meraki Integration. TRUSTED...

PT-2025-23574 · Qualcomm · Snapdragon +33

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to memory corruption that occurs while processing I2C settings in a camera driver. Recommendations: At the moment, there is no information about a newer version that...

CVE-2025-1485

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even wh...

Juzaweb CMS 安全漏洞

Juzaweb CMS is a content management system developed by Juzaweb Individual Developer based on the Laravel framework and Web platform. A security vulnerability exists in Juzaweb CMS 3.4.2 and earlier versions, which stems from improper access control in the file /admin-cp/setting/system/general...

CVE-2025-45474

maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery SSRF in Email Settings...

CVE-2025-48948 Navidrome Transcoding Permission Bypass Vulnerability Report

Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating,...