PT-2025-49337

The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the...

WordPress Helloprint plugin <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Helloprint versions = 2.1.2...

CVE-2025-14107

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safedir results in command injection. The...

CVE-2025-14107

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safedir results in command injection. The...

CVE-2025-14106

creationtimestamp| type| source ---|---|--- 2025-12-05 22:01:48+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115669212005556559 2025-12-05 23:05:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7blxudx2y2a 2025-12-06 06:10:07+00:00| seen|...

CVE-2025-14107 ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safedir results in command injection. The...

CVE-2025-14107 ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safedir results in command injection. The...

Envoy forwards early CONNECT data in TCP proxy mode

Summary Forwarding of early CONNECT data in TCP proxy mode. Details Per RFC 7231-4.3.6 the sender of CONNECT and all inbound proxies switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxie...

GHSA-RJ35-4M94-77JH Envoy forwards early CONNECT data in TCP proxy mode

Summary Forwarding of early CONNECT data in TCP proxy mode. Details Per RFC 7231-4.3.6 the sender of CONNECT and all inbound proxies switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxie...

GHSA-7X2J-2674-FJ95

creationtimestamp| type| source ---|---|--- 2025-12-05 17:00:11+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115668026058293996...

GHSA-HQ6C-R898-FGF2

creationtimestamp| type| source ---|---|--- 2025-12-05 16:53:00+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667997784638676...

GHSA-495W-CQV6-WR59

creationtimestamp| type| source ---|---|--- 2025-12-05 16:43:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667959131777282...

GHSA-QCW2-P26M-9GC5

creationtimestamp| type| source ---|---|--- 2025-12-05 16:43:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667959131777282...

GHSA-2XPW-W6GG-JR37

creationtimestamp| type| source ---|---|--- 2025-12-05 16:24:23+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667885290569342 2025-12-05 17:54:47+00:00| seen| https://seclists.org/oss-sec/2025/q4/250...

CVE-2025-14092

creationtimestamp| type| source ---|---|--- 2025-12-05 16:13:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667841253149237...

CVE-2025-55184

creationtimestamp| type| source ---|---|--- 2025-12-05 13:54:28+00:00| seen| https://vulnerability.circl.lu/bundle/6739b288-995a-4f1a-9f03-5d1ced3a8fbd 2025-12-11 20:51:04+00:00| seen| https://bsky.app/profile/react.dev/post/3m7qhaqdxuc2v 2025-12-11 20:51:04+00:00| seen|...

CVE-2025-10055

creationtimestamp| type| source ---|---|--- 2025-12-05 12:53:27+00:00| seen| https://gist.github.com/Darkcrai86/8b7d6f7f145721ec619c193e6a52f0b9...

CERTFR-2025-ALE-014

creationtimestamp| type| source ---|---|--- 2025-12-05 10:25:20+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115666473271240932...

CVE-2025-12355

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...

CVE-2025-12355 Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...