PT-2025-39715

Name of the Vulnerable Software and Affected Versions HidePost plugin for WordPress versions prior to 2.3.9 Description The software is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the options.php settings page. This allows unauthenticated attacke...

PT-2025-39716

Name of the Vulnerable Software and Affected Versions cForms – Light speed fast Form Builder plugin for WordPress versions through 3.0.0 Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the cforms api function. This allows...

CVE-2025-55847

Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...

CVE-2025-55847

Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...

CVE-2025-10490 Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-10377

The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sdtogglelogs function. This makes it possible for unauthenticated attackers to toggle critical logging settings...

CVE-2025-10377 System Dashboard <= 2.8.20 - Cross-Site Request Forgery

The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sdtogglelogs function. This makes it possible for unauthenticated attackers to toggle critical logging settings...

CVE-2025-10377

CVE-2025-10377 affects the WordPress System Dashboard plugin. It enables Cross-Site Request Forgery due to missing nonce validation in sd_toggle_logs(), allowing unauthenticated attackers to toggle Page Access Logs, Error Logs, and Email Delivery Logs by luring an admin to click a forged link. Af...

CVE-2025-10173

Technical details about CVE-2025-10173 (ShopEngine Elementor WooCommerce Builder Addon) are not provided in the connected documents. Monitor for updates from vendors/security advisories.

CVE-2025-55847

Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...

PT-2025-39485

Name of the Vulnerable Software and Affected Versions ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution versions prior to 4.8.4 Description The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is susceptible to unauthorized access. This is due to ...

PT-2025-39661

Name of the Vulnerable Software and Affected Versions DIR-823 firmware version 20250416 Description A remote code execution issue exists in the set cassword settings interface. The http casswd parameter does not properly filter the '&' character, allowing for the injection of reverse connection...

CVE-2025-55848

CVE-2025-55848 affects the DIR-823 family (firmware 20250416). Root cause: the set_cassword/settings interface does not properly filter the http_casswd parameter, enabling code execution via injection of reverse-connection commands. Impact stated across sources is remote code execution with high ...

PT-2025-39670

Name of the Vulnerable Software and Affected Versions Wavlink M86X3A V240730 affected versions not specified Description The software contains a buffer overflow issue in the /cgi-bin/ExportAllSettings.cgi file. The problem is due to insufficient validation of the length of input data received...

Wavlink M86X3A_V240730 安全漏洞

Wavlink M86X3AV240730 is a device firmware from China Ruiyin Wavlink. A security vulnerability exists in Wavlink M86X3AV240730, which originates from a cookie parameter in the /cgi-bin/ExportAllSettings.cgi file that does not correctly validate the length of the input data, which could result in...

CVE-2025-55847

The CVE-2025-55847 entry concerns Wavlink M86X3A_V240730. The vulnerability is a buffer overflow in the /cgi-bin/ExportAllSettings.cgi endpoint caused by improper validation of the length of data passed via the Cookie parameter. The issue can allow attackers to execute arbitrary code or cause a d...

CVE-2025-36857

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom...

LinkedIn will use your data to train its AI unless you opt out now

LinkedIn plans to share user data with Microsoft and its affiliates for AI training. Framed as "legitimate interest", it won't ask for your permission—instead you'll have to opt out before the deadline. Microsoft has made major investments in ChatGPT’s creator OpenAI, and as we know, the more dat...

Applying Custom Settings to Veeam Software Appliance

Purpose This article documents the configuration files on the Veeam Software Appliance that correspond to registry locations in Windows used for custom settings in Veeam Backup & Replication. Custom registry-based settings for Veeam Backup & Replication on Windows can also be applied to the Veeam...

CVE-2025-9054

CVE-2025-9054 affects the MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress. The issue is unauthorized modification of data due to a missing capability check in the wcmlim_settings_ajax_handler, impacting all versions up to 4.2.8. This allows unauthenticated attack...