PT-2025-15313 · Unknown · Mrcen Springboot-Ucan-Admin

Name of the Vulnerable Software and Affected Versions: mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509 Description: A vulnerability was found in the Personal Settings Interface component of mrcen springboot-ucan-admin, affecting an unknown part of the file...

CVE-2025-28403

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings...

WordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika in WordPress Plugin Internal Link Optimiser versions = 5.1.2...

CVE-2025-3328

CVE-2025-3328 affects the Tenda AC1206 router (firmware 15.03.06.23). The issue is a buffer overflow in the function /goform/fast_setting_wifi_set (form_fast_setting_wifi_set) caused by unbounded input in the ssid and/or timeZone parameters. It can be triggered remotely over the network, with rep...

PT-2025-15244 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the editSave method, which does not properly validate whether the requesting user has administrative privileges before allowing modificatio...

Tenda AC1206 缓冲区错误漏洞

Shenzhen Jixiang Tengda Technology Co., Ltd AC1206 is a high-performance wireless router designed for 200M and above broadband users. A buffer overflow vulnerability exists in the Shenzhen Jixiang Tengda Technology Company Limited AC1206. The vulnerability stems from the formfastsettingwifiset...

CVE-2025-28403

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings...

CVE-2024-13898

The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output...

PT-2025-18032 · Totolink · Totolink N150Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N150RT version 3.4.0-B20190525 Description: A vulnerability was found in the LAN Settings Page component, specifically in the /boafrm/fromStaticDHCP file. The manipulation of the Hostname argument leads to cross-site scripting. The...

Updated corosync packages fix security vulnerability

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet. CVE-2025-30472...

CVE-2025-32269 WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms allows Cross Site Request Forgery. This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through 1.1.3...

CVE-2025-32270 WordPress Broadstreet Plugin <= 1.51.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Broadstreet Broadstreet allows Cross Site Request Forgery. This issue affects Broadstreet: from n/a through 1.51.1...

CVE-2025-32268

Technical details about CVE-2025-32268 are not publicly provided in the supplied documents. No confirmed affected products, versions, or fixes are disclosed here. Monitor for official advisories and updates.

CVE-2025-32241 WordPress Official CleverReach WooCommerce Integration Plugin <= 3.4.3 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce allows Cross Site Request Forgery. This issue affects Official CleverReach Plugin for WooCommerce: from n/a through 3.4.3...

CVE-2025-32241 WordPress Official CleverReach WooCommerce Integration plugin <= 3.4.6 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce cleverreach-wc allows Cross Site Request Forgery.This issue affects Official CleverReach Plugin for WooCommerce: from n/a through = 3.4.6...

CVE-2025-0415

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for...

CVE-2024-13898

CVE-2024-13898 concerns the WordPress plugin “Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website.” The connected documents confirm a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escapi...

CVE-2024-13898 Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output...

VulnCheck KEV: CVE-2025-2907

The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to...

CVE-2025-30354

Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This...