CVE-2025-39417

Cross-Site Request Forgery CSRF vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through = 2.0...

CVE-2025-32637: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ketanajani WP Donate wp-donate allows Stored XSS.This issue affects WP Donate: from n/a through = 2.0...

CVE-2025-32072: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43...

CVE-2025-32591: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Cross Site Request Forgery.This issue affects WP Abstracts: from n/a through = 2.7.5...

CVE-2025-30908

Cross-Site Request Forgery CSRF vulnerability in Shamalli Web Directory Free web-directory-free allows Stored XSS.This issue affects Web Directory Free: from n/a through = 1.7.6...

PT-2025-14542 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue is a SQL injection vulnerability via the stu id parameter at the "/modules/students/Student.php" API endpoint. Recommendations: For OS4ED openSIS versions 7.0 through 9.1, consider...

PT-2025-14193 · Xtreme · Planyo

Name of the Vulnerable Software and Affected Versions: xtreeme Planyo online reservation system versions n/a through 3.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that a...

PT-2025-14154 · Unknown · Post Custom Templates Lite

Name of the Vulnerable Software and Affected Versions: Post Custom Templates Lite versions n/a through 1.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker ca...

Drupal Google Tag 跨站请求伪造漏洞

Drupal Google Tag is a Drupal community module for integrating Google Tag Manager in Drupal websites. A cross-site request forgery vulnerability exists in Drupal Google Tag versions prior to 1.8.0 and versions prior to 2.0.0 through 2.0.8 that stems from cross-site request forgery...

CVE-2025-30893: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through = 3.0.2...

Apache Tomcat Remote Code Execution

Apache Tomcat proof of concept remote code execution exploit that affects versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98...

Fedora 40 : xen (2025-20bd6d94b9)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-20bd6d94b9 advisory. deadlock potential with VT-d and legacy PCI device pass-through XSA-467, CVE-2025-1713 Tenable has extracted the preceding description block directly from th...

GE Vernova UR IED 输入验证错误漏洞

The GE Vernova UR IED is a series of protection relays from GE Vernova, USA. An input validation error vulnerability exists in GE Vernova UR IED versions 7.0 through 8.60, which stems from improper input validation and allows an attacker to establish a TCP connection via port forwarding...

Esri ArcGIS Server File Inclusion Vulnerability

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A file inclusion vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by a remote, unauthenticated attacker to read internal files due to a failure...

CVE-2025-1858

A vulnerability classified as critical was found in Codezips Online Shopping Website 1.0. This vulnerability affects unknown code of the file /success.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the publi...

SUSE CVE-2025-21746

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse...

deadlock potential with VT-d and legacy PCI device pass-through

ISSUE DESCRIPTION When setting up interrupt remapping for legacy PCI-X devices, including PCI-X bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock. IMPACT Th...

DEBIAN-CVE-2025-21746

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse...

CVE-2025-21746

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse...

UBUNTU-CVE-2025-21746

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse...