Advisory ROSA-SA-2025-2996

software: grub2 2.06 WASP: ROSA-CHROME unaffected versions = grub2-2.06-23 affected versions grub2-2.06-23 CVE-ID: CVE-2024-45777 BDU-ID: 2025-07120 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the gettext component of the Grub operating systems loader is related to integer overflow. Exploitation...

WordPress The integration of the AMO.CRM plugin <= 1.0.1 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Claw.k in WordPress Plugin The integration of the AMO.CRM versions = 1.0.1...

WordPress My WP Translate plugin <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin My WP Translate versions = 1.1...

WordPress My WP Translate plugin <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Option Read and Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin My WP Translate versions = 1.1...

WordPress Countdown Timer for Elementor plugin <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'countdownlabel' vulnerability discovered by zer0gh0st in WordPress Plugin Countdown Timer for Elementor versions = 1.3.9...

WordPress eID Easy plugin <= 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin eID Easy versions = 4.9.3...

WordPress Digital Events Calendar plugin <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via column Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Digital Events Calendar versions = 1.0.8...

WordPress Mixtape plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang in WordPress Plugin Mixtape versions = 1.1...

WordPress AutoCatSet plugin <= 2.1.4 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin AutoCatSet versions = 2.1.4...

WordPress azurecurve BBCode plugin <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin azurecurve BBCode versions = 2.0.4...

WordPress All in one Minifier plugin <= 3.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by p0cket in WordPress Plugin All in one Minifier versions = 3.2...

WordPress Evenium plugin <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Evenium versions = 1.3.11...

WordPress Mitfahrgelegenheit plugin <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via date Parameter vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Mitfahrgelegenheit versions = 1.1.5...

WordPress Smartcat Translator for WPML plugin <= 3.1.72 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Smartcat Translator for WPML versions = 3.1.72...

WordPress Certifica WP plugin <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via evento Parameter vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Certifica WP versions = 3.1...

WordPress Plugin updates blocker plugin <= 0.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Plugin updates blocker versions = 0.2...

WordPress Jobify - Job Board WordPress Theme Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Jobify - Job Board WordPress Theme Type Theme Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-8318 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID edb43386dd8c Credits Muhammad...

CVE-2025-10201

Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: High...

Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2025-2115)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2017-0413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate...