CVE-2025-58160

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into...

CVE-2025-58160 Tracing logging user input may result in poisoning logs with ANSI escape sequences

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into...

CVE-2025-58160 Tracing logging user input may result in poisoning logs with ANSI escape sequences

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into...

a3s-lane (>=0.1.0, <=0.4.0), abci-rs (>=0.7.0, <=0.11.3) +4262 more potentially affected by CVE-2025-58160 via tracing-subscriber (>=0.1.6, <=0.3.19)

tracing-subscriber CARGO version =0.1.6, =0.1.0, =0.7.0, =0.5.0-rc.0, =0.5.0-rc.0, =0.5.0, =0.1.5, =0.0.1-dev.10, =1.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.1, =0.5.0, =0.7.0-rc.2 and more Source cves: CVE-2025-58160 Source advisory: OSV:GHSA-XWFJ-JGWM-7WP5...

GHSA-XWFJ-JGWM-7WP5 Tracing logging user input may result in poisoning logs with ANSI escape sequences

Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens o...

a3s-lane (>=0.1.0, <=0.4.0), abci-rs (>=0.7.0, <=0.11.3) +4262 more potentially affected by CVE-2025-58160 via tracing-subscriber (>=0.1.6, <=0.3.19)

tracing-subscriber CARGO version =0.1.6, =0.1.0, =0.7.0, =0.5.0-rc.0, =0.5.0-rc.0, =0.5.0, =0.1.5, =0.0.1-dev.10, =1.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.1, =0.5.0, =0.7.0-rc.2 and more Source cves: CVE-2025-58160 Source advisory: OSV:RUSTSEC-2025-0055...

CVE-2025-8147

The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscacheactivatePlugin function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-8147 LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function

The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscacheactivatePlugin function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-8147

The CVE-2025-8147 entry concerns the WordPress LWSCache plugin (versions up to and including 2.8.5). The underlying issue is improper authorization in the lwscache_activatePlugin() function, allowing authenticated users with Subscriber-level access and above to activate arbitrary whitelisted LWS ...

CVE-2025-8147 LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function

The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscacheactivatePlugin function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

PT-2025-35187

Name of the Vulnerable Software and Affected Versions: LWSCache plugin for WordPress versions up to and including 2.8.5 Description: The LWSCache plugin for WordPress is susceptible to unauthorized data modification because of insufficient authorization within the lwscache activatePlugin function...

CVE-2025-9345

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajaxdownloadfile function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions ...

CVE-2025-0951

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquidresetwordpressbefore AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivat...

CVE-2025-9345 File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajaxdownloadfile function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions ...

CVE-2025-9345

CVE-2025-9345 : Path Traversal to Arbitrary File Download in the WordPress plugin “File Manager, Code Editor, and Backup by Managefy.” Affected versions: all up to 1.4.8. Root cause per sources: authenticated users (Subscriber level and higher) can leverage ajax_downloadfile() to access files out...

CVE-2025-0951 LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquidresetwordpressbefore AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivat...

CVE-2025-0951

Summary of CVE-2025-0951 (LiquidThemes for WordPress): The issue arises from a missing capability check in the liquid_reset_wordpress_before AJAX path across LiquidThemes plugins/themes, enabling authenticated attackers with Subscriber-level access and above to deactivate all plugins. The root ca...

CVE-2025-0951 LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquidresetwordpressbefore AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivat...

PT-2025-34963

Name of the Vulnerable Software and Affected Versions: File Manager, Code Editor, and Backup by Managefy plugin for WordPress versions prior to 1.4.9 Description: The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is susceptible to a Path Traversal issue in versions up to...

PT-2025-34961

Name of the Vulnerable Software and Affected Versions: LiquidThemes WordPress plugins and themes affected versions not specified Description: Multiple plugins and/or themes developed by LiquidThemes for WordPress are susceptible to unauthorized access due to the absence of a capability check with...