11808 matches found
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
...
SUSE CVE-2025-3408
A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stbdupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product...
PT-2025-15728 · Unknown · Webliberty Simple Spoiler
Name of the Vulnerable Software and Affected Versions: Webliberty Simple Spoiler versions n/a through 1.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...
WordPress Streamit plugin <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download vulnerability
Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by István Márton in WordPress Theme Streamit versions = 4.0.1...
A week in security (March 31 – April 6)
Last week on Malwarebytes Labs: Why we’re no longer doing April Fools’ Day Intimate images from kink and LGBTQ+ dating apps left exposed online "Urgent reminder" tax scam wants to phish your Microsoft credentials "Nudify" deepfakes stored unprotected online Location, name, and photos of random ki...
CVE-2025-32132
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Stored XSS.This issue affects FunnelCockpit: from n/a through = 1.4.3...
CVE-2025-32136
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in activecampaign ActiveCampaign activecampaign-subscription-forms allows Stored XSS.This issue affects ActiveCampaign: from n/a through = 8.1.16...
CVE-2025-31903
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through = 2.0.0...
CVE-2025-32249
Cross-Site Request Forgery CSRF vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPress: from n/a through = 3.6.22...
CVE-2025-32133
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through =...
CVE-2025-32271 WordPress Woocommerce Role Pricing Plugin <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in ablancodev Woocommerce Role Pricing allows Cross Site Request Forgery. This issue affects Woocommerce Role Pricing: from n/a through 3.5.5...
CVE-2025-32249 WordPress DirectoryPress Plugin <= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPress: from n/a through = 3.6.22...
CVE-2025-32149
CVE-2025-32149 affects the WordPress plugin teachPress (up to 9.0.11). The issue is an SQL injection caused by improper neutralization of input in the plugin, with exploitation requiring authentication (Contributor+). Current references indicate the patch status is Unpatched; no exploits or in-th...
CVE-2025-31389
The CVE-2025-31389 entry covers a Reflected XSS in the Sequel plugin (Sequel.io Sequel) for the Sequel: from n/a through 1.0.11. Connected sources confirm the issue is a cross-site scripting vulnerability in the web page generation path, caused by improper input neutralization. The Wordfence entr...
CVE-2025-3197
Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto...
WordPress plugin SurveyJS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...
CVE-2025-31855
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through = 6.0.31...
CVE-2025-31792
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through = 1.0.30...
CVE-2025-31864
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through = 1.0.23...