CVE-2025-30866

Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through = 1.2.15...

CVE-2025-30866

Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through = 1.2.15...

WordPress Terms & Conditions Per Product plugin <= 1.2.15 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Terms & Conditions Per Product versions = 1.2.15...

CVE-2025-30866

CVE-2025-30866 – The Terms & Conditions Per Product plugin suffers a Missing Authorization flaw due to incorrectly configured access control. Affected Software: Terms & Conditions Per Product (from n/a up to 1.2.15). Underlying cause: improperly configured access control levels that allow unautho...

CVE-2025-30866: Missing Authorization

Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through = 1.2.15...

CVE-2025-2302 Advanced Woo Search <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode

The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's awssearchterms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Advanced Woo Search plugin <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via awssearchterms Shortcode vulnerability discovered by yudha in WordPress Plugin Advanced Woo Search versions = 3.28...

Malicious code in miro-terms-banner-s3-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03f414cb9ba131f7c282fb402bda0fd181018874345ee729525f90005f100e4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in miro-terms-banner-s3-uploader

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2025-12836

Name of the Vulnerable Software and Affected Versions Advanced Woo Search plugin for WordPress versions up to, and including, 3.28 Description The issue is related to Stored Cross-Site Scripting via the plugin's aws search terms shortcode due to insufficient input sanitization and output escaping...

PT-2025-12519

Name of the Vulnerable Software and Affected Versions Terms & Conditions Per Product versions 1.2.15 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations For versions...

Mozilla Tweaks Firefox Terms After Uproar Over Data Use Language

Firefox's new Terms of Use spark user backlash over data rights. Learn how Mozilla responded to concerns about…...

Mozilla Updates Firefox Terms Again After Backlash Over Broad Data License Language

Firefox browser maker Mozilla on Friday updated its Terms of Use a second time within a week following criticism overbroad language that appeared to give the company the rights to all information uploaded by users. The revised Terms of Use now states - You give Mozilla the rights necessary to...

WordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Terms Dictionary versions = 1.5.1...

BIT-GITLAB-2024-2878 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names...

CVE-2024-2878

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names...

CVE-2024-2878 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names...

CVE-2024-2878 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names...

CVE-2024-2878: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names...

CVE-2025-23752

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Clifton Griffin CGD Arrange Terms shopp-arrange allows Reflected XSS.This issue affects CGD Arrange Terms: from n/a through = 1.1.3...