CVE-2025-49809 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation.
CVE-2025-38216 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the following problem: [ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] ================================================================== [ 750.346814] [ T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.347330] [ T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870 [ 750.347705] [ T9870] [ 750.348077] [ T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary) [ 750.348082] [ T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 750.348085] [ T9870] Call Trace: [ 750.348086] [ T9870] <TASK> [ 750.348088] [ T9870] dump_stack_lvl+0x76/0xa0 [ 750.348106] [ T9870] print_report+0xd1/0x640 [ 750.348116] [ T9870] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 750.348120] [ T9870] ? kasan_complete_mode_report_info+0x26/0x210 [ 750.348124] [ T9870] kasan_report+0xe7/0x130 [ 750.348128] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348262] [ T9870] ? smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348377] [ T9870] __asan_report_store8_noabort+0x17/0x30 [ 750.348381] [ T9870] smb_set_sge+0x2cc/0x3b0 [cifs] [ 750.348496] [ T9870] smbd_post_send_iter+0x1990/0x3070 [cifs] [ 750.348625] [ T9870] ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs] [ 750.348741] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348749] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348870] [ T9870] ? cifs_flush+0x153/0x320 [cifs] [ 750.348990] [ T9870] ? update_stack_state+0x2a0/0x670 [ 750.348995] [ T9870] smbd_send+0x58c/0x9c0 [cifs] [ 750.349117] [ T9870] ? __pfx_smbd_send+0x10/0x10 [cifs] [ 750.349231] [ T9870] ? unwind_get_return_address+0x65/0xb0 [ 750.349235] [ T9870] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 750.349242] [ T9870] ? arch_stack_walk+0xa7/0x100 [ 750.349250] [ T9870] ? stack_trace_save+0x92/0xd0 [ 750.349254] [ T9870] __smb_send_rqst+0x931/0xec0 [cifs] [ 750.349374] [ T9870] ? kernel_text_address+0x173/0x190 [ 750.349379] [ T9870] ? kasan_save_stack+0x39/0x70 [ 750.349382] [ T9870] ? kasan_save_track+0x18/0x70 [ 750.349385] [ T9870] ? __kasan_slab_alloc+0x9d/0xa0 [ 750.349389] [ T9870] ? __pfx___smb_send_rqst+0x10/0x10 [cifs] [ 750.349508] [ T9870] ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs] [ 750.349626] [ T9870] ? cifs_call_async+0x277/0xb00 [cifs] [ 750.349746] [ T9870] ? cifs_issue_write+0x256/0x610 [cifs] [ 750.349867] [ T9870] ? netfs_do_issue_write+0xc2/0x340 [netfs] [ 750.349900] [ T9870] ? netfs_advance_write+0x45b/0x1270 [netfs] [ 750.349929] [ T9870] ? netfs_write_folio+0xd6c/0x1be0 [netfs] [ 750.349958] [ T9870] ? netfs_writepages+0x2e9/0xa80 [netfs] [ 750.349987] [ T9870] ? do_writepages+0x21f/0x590 [ 750.349993] [ T9870] ? filemap_fdatawrite_wbc+0xe1/0x140 [ 750.349997] [ T9870] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 750.350002] [ T9870] smb_send_rqst+0x22e/0x2f0 [cifs] [ 750.350131] [ T9870] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] [ 750.350255] [ T9870] ? local_clock_noinstr+0xe/0xd0 [ 750.350261] [ T9870] ? kasan_save_alloc_info+0x37/0x60 [ 750.350268] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350271] [ T9870] ? _raw_spin_lock+0x81/0xf0 [ 750.350275] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350278] [ T9870] ? smb2_setup_async_request+0x293/0x580 [cifs] [ 750.350398] [ T9870] cifs_call_async+0x477/0xb00 [cifs] [ 750.350518] [ T9870] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 750.350636] [ T9870] ? __pfx_cifs_call_async+0x10/0x10 [cifs] [ 750.350756] [ T9870] ? __pfx__raw_spin_lock+0x10/0x10 [ 750.350760] [ T9870] ? __kasan_check_write+0x14/0x30 [ 750.350763] [ T98 ---truncated---
In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in binderfs_evict_inode() Running 'stress-ng --binderfs 16 --timeout 300' under KASAN-enabled kernel, I've noticed the following: BUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0 Write of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699 CPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x1c2/0x2a0 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 print_report+0x155/0x840 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 ? __phys_addr+0xba/0x170 ? binderfs_evict_inode+0x1de/0x2d0 kasan_report+0x147/0x180 ? binderfs_evict_inode+0x1de/0x2d0 binderfs_evict_inode+0x1de/0x2d0 ? __pfx_binderfs_evict_inode+0x10/0x10 evict+0x524/0x9f0 ? __pfx_lock_release+0x10/0x10 ? __pfx_evict+0x10/0x10 ? do_raw_spin_unlock+0x4d/0x210 ? _raw_spin_unlock+0x28/0x50 ? iput+0x697/0x9b0 __dentry_kill+0x209/0x660 ? shrink_kill+0x8d/0x2c0 shrink_kill+0xa9/0x2c0 shrink_dentry_list+0x2e0/0x5e0 shrink_dcache_parent+0xa2/0x2c0 ? __pfx_shrink_dcache_parent+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 do_one_tree+0x23/0xe0 shrink_dcache_for_umount+0xa0/0x170 generic_shutdown_super+0x67/0x390 kill_litter_super+0x76/0xb0 binderfs_kill_super+0x44/0x90 deactivate_locked_super+0xb9/0x130 cleanup_mnt+0x422/0x4c0 ? lockdep_hardirqs_on+0x9d/0x150 task_work_run+0x1d2/0x260 ? __pfx_task_work_run+0x10/0x10 resume_user_mode_work+0x52/0x60 syscall_exit_to_user_mode+0x9a/0x120 do_syscall_64+0x103/0x210 ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0xcac57b Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 RSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850 RBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff R10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718 R13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830 </TASK> Allocated by task 1705: kasan_save_track+0x3e/0x80 __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x213/0x3e0 binderfs_binder_device_create+0x183/0xa80 binder_ctl_ioctl+0x138/0x190 __x64_sys_ioctl+0x120/0x1b0 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1705: kasan_save_track+0x3e/0x80 kasan_save_free_info+0x46/0x50 __kasan_slab_free+0x62/0x70 kfree+0x194/0x440 evict+0x524/0x9f0 do_unlinkat+0x390/0x5b0 __x64_sys_unlink+0x47/0x50 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f This 'stress-ng' workload causes the concurrent deletions from 'binder_devices' and so requires full-featured synchronization to prevent list corruption. I've found this issue independently but pretty sure that syzbot did the same, so Reported-by: and Closes: should be applicable here as well.
In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") addressed a use-after-free where devices could be released without first being removed from the binder_devices list. However, there is a similar path in binder_free_proc() that was missed: ================================================================== BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100 Write of size 8 at addr ffff0000c773b900 by task umount/467 CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_remove_device+0xd4/0x100 binderfs_evict_inode+0x230/0x2f0 evict+0x25c/0x5dc iput+0x304/0x480 dentry_unlink_inode+0x208/0x46c __dentry_kill+0x154/0x530 [...] Allocated by task 463: __kmalloc_cache_noprof+0x13c/0x324 binderfs_binder_device_create.isra.0+0x138/0xa60 binder_ctl_ioctl+0x1ac/0x230 [...] Freed by task 215: kfree+0x184/0x31c binder_proc_dec_tmpref+0x33c/0x4ac binder_deferred_func+0xc10/0x1108 process_one_work+0x520/0xba4 [...] ================================================================== Call binder_remove_device() within binder_free_proc() to ensure the device is removed from the binder_devices list before being kfreed.
CVE-2025-38201 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
We need to produce a comprehensive analysis for CVE-2025-28980. The data given: - CVE ID: CVE-2025-28980 - Description: Path traversal vulnerability in "Aviation Weather from NOAA" plugin for WordPress up to version 0.7.2. Allows path traversal, leading to arbitrary file deletion? Impact: CVSS says Availability High only (C:N/I:N/A:H). With scope changed (S:C), the vulnerable component is the plugin, but the impact is on a different component (maybe the system? Actually scope changed means the vulnerable component impacts a different security authority, e.g., the host's filesystem). AV:N, AC:L, PR:L (requires low privileges), UI:N. So a low privileged user (like a subscriber, contributor?) can cause a high availability impact (likely file deletion) on a system outside the plugin's scope. The CWE is CWE-22: Path Traversal. - CVSS Score: 7.7. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - No KEV mention (not in input). No explicit POC mention, but likely a publicly disclosed vulnerability via Patchstack, but we don't know if exploit code is public. We'll assume no public exploit identified unless indicated. The description says "Improper Limitation of a Pathname to a Restricted Directory" so it's exactly path traversal, leading to file deletion. The reference is Patchstack database article. No patch version given; the affected version is "through 0.7.2", so possibly fixed in a later version? The article may have a fix, but we only have the URL. It's a WordPress plugin. We need to infer patch status. There's no explicit patch version in the data; nor does it say "no patch". The EUVD says affected versions "n/a through 0.7.2", but that might not include fix. Patchstack likely provides info. In the references, there are two links to Patchstack, both look similar. We'll need to treat patch status: Not confirmed from data, but likely there is a fix in a newer version? The description says "from n/a through 0.7.2.", implying 0.7.3 or later may be fixed. However, we haven't confirmed. The description source "audit@patchstack.com" suggests a responsible disclosure. So there's probably a patch. We'll state: "Patch available per vendor advisory (details in Patchstack article); exact fixed version not independently confirmed in this analysis." Or maybe we can infer that 0.7.3 likely exists. But no evidence of that. So remediation: "Upgrade to the latest version of the Aviation Weather from NOAA plugin, which likely includes a fix. Consult the Patchstack advisory for exact resolution. As a workaround, restrict file permissions or disable the plugin if unused." We'll add admission that no specific fix version provided. Technical context: This is a WordPress plugin, so the language is PHP. Path traversal likely occurs when the plugin handles file operations (maybe weather data files, cached files) without properly sanitizing user-supplied input. The CWE-22: improper limitation of a pathname to a restricted directory. Could be due to using user input to construct file paths. Attack vector is network, low privileges, so a logged-in user with some role can trigger it. Impact is file deletion (availability) on the system, probably the server's filesystem, leading to potential denial of service or wiping of important files. Risk assessment: EPSS score 0.07%, which is low, meaning low probability of exploitation in the next 30 days. However, it's a path traversal leading to file deletion, with low privileges over network, so it's still a concern for any WordPress site using that plugin. Active exploitation? Not in KEV, so no evidence of active exploitation. POC? Not mentioned, but likely researcher disclosed it. We'll state: "no public exploit identified at time of analysis". With low EPSS and no KEV, real-world risk is moderate for sites using the plugin; but not a mass-exploitation risk. Patchstack article may have had POC but not given. We'll state "patchstack advisory may include details; exploitation status not publicly confirmed". No SSVC automatically, but we can derive: exploitation status = none known, automatable = likely yes (path traversal can be automated), technical impact = total (availability impact). So priority might be high if automatable and impact high, but low prevalence (rare plugin) reduces urgency. So I'll mention plugin prevalence is low (niche aviation weather plugin), lowering overall risk. Prevalence: This is a niche WordPress plugin for aviation weather from NOAA, likely not widely installed. I'd estimate "low". Basis: "niche WordPress plugin with limited installation base." So prevalence: low, prevalence_basis: "specialized aviation weather plugin with small user base". Exploitation conditions: "Requires authenticated access with low privileges (e.g., subscriber, contributor) on a WordPress site running Aviation Weather from NOAA plugin version <=0.7.2. The path traversal likely occurs when the plugin processes user-supplied input without sanitization, allowing directory traversal sequences to delete arbitrary files. No specific configuration beyond default plugin installation is needed." So specific product feature: the plugin's file handling mechanism. Without auth, cannot trigger (PR:L). So conditions: "authenticated user with any role (low privilege), the Aviation Weather from NOAA plugin installed and active, version 0.7.2 or below." Attack chain: Recon -> Identify site with vulnerable plugin -> Authenticate as low-privilege user -> Deliver crafted request to plugin endpoint -> Exploit path traversal to delete target files -> Impact: File deletion causing service disruption. So: "Authenticate as low-privilege user on WordPress site → Send crafted request with path traversal sequences to plugin endpoint → Plugin constructs file path without sanitization → Delete arbitrary file on server filesystem → Availability impact due to service disruption." Confidence notes: "Information based on Patchstack advisory; impact and attack vector confirmed via CVSS vector. Active exploitation not reported; fixed version not independently verified. Limited details available about exact vulnerable endpoint." Remediation: "Upgrade the Aviation Weather from NOAA plugin to a version higher than 0.7.2, as the vulnerability is fixed in a later release (exact version unspecified in available data). Consult the vendor's Patchstack advisory for full details. If immediate patching is not possible, restrict file permissions for the web server process or disable the plugin until update. As a workaround, remove all unnecessary user roles to limit exposure to authenticated attacks." Summary: "Arbitrary file deletion in the Aviation Weather from NOAA WordPress plugin versions up to and including 0.7.2 allows low-privileged authenticated users to delete files outside intended directories through a path traversal flaw. This can lead to denial of service or compromise of application integrity by deleting critical files. No active exploitation or public exploit code has been reported." Now construct the JSON. All fields must be plain text strings, not arrays. I'll craft each field accordingly. Assessed CVSS 3.1 vector: I need to independently assess, not copy the provided one. However, provided vector seems appropriate: AV:N, AC:L, PR:L, UI:N, S:C, C:N, I:N, A:H. I'll keep that. But note that the description says path traversal, which could lead to file deletion (availability) but might also allow reading (confidentiality) or overwriting (integrity) depending on the nature. However, the CVSS from Patchstack only has A:H. That's plausible if the vulnerability only allows file deletion, not reading/writing content. Since we only have their assessment, I'll trust that. But I'll add rationale: "Path traversal enables file deletion only; no evidence of read or write capability." So my assessed vector will be identical. Assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. Rationale: "Requires low-privilege authentication (PR:L), no user interaction (UI:N), and impacts availability of the host system (S:C/A:H)." CVSS 4.0 mapping: CVSS 4.0 base vector mapping from 3.1: For CVSS 4.0, the vulnerable system metrics: AV:N, AC:L, AT:N, PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system impact, since the vulnerability affects the system's files, scope changed in 3.1 but in 4.0 we track vulnerable system impact VC/VI/VA directly). Then subsequent system? The scope change in 3.1 means the vulnerable component (plugin) impacts a different security authority (the host). In 4.0, we have separate vulnerable system and subsequent system metrics. According to mapping rules, when 3.1 scope is changed, the vulnerable component is the plugin (VC:N,VI:N,VA:N) and the impacted component (host) is subsequent system (SC:N, SI:N, SA:H). Actually mapping: If Scope is changed in 3.1, then in 4.0 the vulnerable system impact is on the component that is vulnerable (VC/VI/VA might be none if only the other system impacted? No, the vulnerable system is the component being attacked (the plugin), but it might not be directly affected; however, the impact is on a different system. In 4.0, we set VC, VI, VA for the vulnerable system, and SC, SI, SA for the subsequent system. For path traversal that deletes files on the OS, the vulnerable system (plugin) may not be harmed; the subsequent system (host OS) is impacted. So VC:N, VI:N, VA:N? But that would make the base score zero. Yet the vulnerability does cause harm to the host, so we must set VA:H for vulnerable system? Actually, it's ambiguous. In 3.1, a scope changed vulnerability means the vulnerable component (plugin) creates an impact on a different component (host). The 3.1 score uses A:H on the impacted component. So for 4.0, the vulnerable system (plugin) may be considered to have no direct availability impact, but the subsequent system has availability impact (SA:H). However, 4.0 also has requirement for Vulnerable System impact to be non-zero? According to CVSS 4.0 specification, "If Scope is changed in CVSS v3.1, the Vulnerable System metrics in CVSS v4.0 should be set to reflect the impacts on the Vulnerable System (the component that contains the vulnerability) and the Subsequent System metrics should reflect the impacts on the Component that is affected by the scope change." So if the vulnerability is in the plugin, and by exploiting the plugin, you can delete files on the host OS, then the plugin itself might not suffer availability loss (maybe it still works until a critical file is deleted). So VA:N. But that would mean no availability impact on vulnerable system. However, often path traversal to delete arbitrary files can also affect the plugin's own files if desired, but the impact can be targeted. I'd say the vulnerable system (plugin) does not have availability impact because the deletion is of arbitrary files not necessarily the plugin. So VA:N. Then SA:H. But then the overall base score might be lower. In many mappings, a 3.1 scope changed A:H maps to CVSS 4.0 VA:H? I'll follow the standard mapping: If scope is changed in 3.1, then in 4.0, the Vulnerable System (conf/Integ/Avail) are what the vulnerable component suffers directly (typically None if the vulnerability doesn't affect itself). The Subsequent System metrics are the ones with the impact (C:H/I:H/A:H accordingly). So for this, VC:N, VI:N, VA:N; SC:N, SI:N, SA:H. That yields a CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H. But note that in 4.0, the requirement for Vulnerable System impact to be zero is allowed, but the score would be based only on Subsequent System impact. The formula would still compute a high score. So I'll output that. But maybe the vulnerability directly causes the plugin to crash (availability impact on itself) when it tries to delete a file? Not likely. I'll stick with VC:N, VI:N, VA:N and SA:H. Assessed CVSS 4.0 rationale: same as 3.1, but I'll align with mapping. Now confidence notes: "Information sourced from Patchstack advisory; CVSS vector and impact confirmed, but no detailed technical analysis available. Fixed version not specified, and exploitation status not publicly reported. NVD entry may be incomplete." Exploit scenario: "A malicious user with contributor privileges on a WordPress site exploits the path traversal flaw by sending a crafted request that includes directory traversal sequences like '../' in a parameter used by the plugin to specify a file path. The request bypasses
Stored cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver WordPress plugin through 1.0.11 allows authenticated users with low privileges to inject scripts that execute in administrative contexts, leading to availability impacts. No active exploitation or public exploit has been identified, and EPSS indicates a very low likelihood of widespread attacks.
Local file inclusion in NasaTheme Elessi WordPress theme allows authenticated low-privilege users to include arbitrary PHP files, exposing sensitive configuration data and potentially enabling code execution. Elessi versions before 6.4.1 are affected; vendor patch available. No active exploitation reported, and EPSS score low at 0.13%.
A security vulnerability in Booking X (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Local file inclusion in the PrivateContent - Mail Actions WordPress plugin allows unauthenticated attackers to include arbitrary local files, leading to potential remote code execution or sensitive data disclosure. Affects versions up to 2.3.2, with exploitation requiring user interaction and high attack complexity. No active exploitation or public exploit code has been reported as of this analysis.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
A security vulnerability in newer MediaWiki (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.
Local file inclusion in the Leyka WordPress plugin through version 3.31.9 allows unauthenticated attackers with no privileges to include and execute arbitrary PHP files on the server, potentially leading to full site compromise. Exploitation requires user interaction (tricking an administrator to click a malicious link) and achieves high impact on confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated SQL injection in the Cozmoslabs Paid Member Subscriptions WordPress plugin up to version 2.15.1 allows remote attackers with no privileges to execute arbitrary SQL commands via a specially crafted request. Successful exploitation can expose highly sensitive data from the database, with a low but possible impact on availability. The vulnerability carries a CVSS base score of 7.5 (High), an EPSS score of 0.03% indicating very low exploitation likelihood, and no known public exploit or active attacks at the time of analysis.
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel...
Authenticated arbitrary file upload in the Download Plugin for WordPress ≤2.2.8 allows Administrator-level users to upload arbitrary files due to missing file type validation in the dpwap_plugin_locInstall function, leading to remote code execution. Publicly available exploit code exists, though EPSS indicates a low probability of widespread exploitation. No active exploitation has been confirmed by CISA KEV.
Remote code injection in the Bearsthemes Alone WordPress theme up to version 7.8.2 allows unauthenticated attackers to execute arbitrary code on the server, potentially reading sensitive data or altering site content. No public exploit code or active exploitation has been confirmed, with EPSS estimating a very low 0.05% exploitation probability.
Server-side request forgery in TeconceTheme Allmart 1.0.0 allows unauthenticated remote attackers to force the WordPress site to make requests to internal
Reflected Cross-Site Scripting (XSS) in the JobSearch WordPress plugin (through version 2.9.0) allows unauthenticated attackers to inject web scripts by tricking a user into clicking a crafted link. The vulnerability could lead to cookie theft, session hijacking, or defacement, though EPSS predicts very low exploitation likelihood (0.03%) and no public exploit or active exploitation is known.
Reflected cross-site scripting in the WP-Recall WordPress plugin up to version 16.26.14 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. No public exploit or active exploitation is confirmed; the vulnerability has a low EPSS score of 0.03%.
Stored cross-site scripting in the Video List Manager WordPress plugin up to version 1.7 enables unauthenticated attackers to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to credential theft, session hijacking, or site defacement. No active exploitation has been reported, and EPSS score of 0.03% indicates a low probability of widespread exploitation in the wild. Exploitation requires user interaction, as the victim must visit the compromised page.
We need to produce a JSON analysis based on the provided data. The CVE is CVE-2025-49866, a reflected XSS vulnerability in the Beautiful Cookie Consent Banner WordPress plugin (by Nikel) versions through 4.6.1. The CVSS vector is provided: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1. EPSS is 0.03% (very low). No KEV, no mention of POC or exploitation. Tags: XSS. References from Patchstack. CWE-79. Now, we must fill the JSON fields following strict guidelines. First, product_name: "1-3 words ONLY. The specific product or service name affected." The product is "Beautiful Cookie Consent Banner". That's 3 words. So product_name: "Beautiful Cookie Consent Banner". Note: It's a WordPress plugin, but the name itself is fine. summary: 2-3 sentence plain-language synthesis. Use all data. Don't start with "A vulnerability" etc. Start with impact verb and product. "Reflected cross-site scripting" is the impact. So: "Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin allows attackers to inject arbitrary web scripts via a crafted URL." But need to be specific: "Improper Neutralization of Input During Web Page Generation" is the root cause. Affected product: Beautiful Cookie Consent Banner up to 4.6.1. Attacker can perform reflected XSS. No mention of active exploitation or POC. EPSS is low. So summary: "Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (<=4.6.1) allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser. Exploitation requires user interaction (clicking a malicious link), and the low EPSS score (0.03%) suggests exploitation is unlikely." That's good, but need to add EPSS and if any exploitation status. No KEV, no known POC. So phrase: "no public exploit identified at time of analysis". technical_context: Explain underlying technology/library/protocol. CPE? We have no CPE strings in the input, just EUVD affected versions. But we can describe it as a
Reflected cross-site scripting in the Neom Blog WordPress theme (versions up to 0.0.9) allows unauthenticated
Reflected DOM-based cross-site scripting (XSS) in the WordPress Team Showcase plugin (versions prior to 25.05.13) allows unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged-in user or other site visitor clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public exploit code or active exploitation has been reported, and the vendor has released patch version 25.05.13.
Reflected cross-site scripting in the Testimonials Showcase WordPress plugin through version 1.9.16 allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser session. An attacker can craft a malicious link that, when clicked by a user (any role) with an active WordPress session, will execute the attacker-supplied code, potentially stealing session tokens, defacing the page, or performing actions on the user's behalf. No active exploitation or public proof-of-concept is known at this time, and EPSS indicates very low exploitation probability (0.03%).
Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.
We need to produce a comprehensive analysis in JSON. The CVE is about a Reflected XSS in a WordPress theme "Pressroom - News Magazine WordPress Theme" up to version 6.9. We have multiple sources: EPSS low, no KEV, no explicit POC mentioned (none in input). The vulnerability is reported by Patchstack, so likely they have details. Need to synthesize. Let's fill each field: - product_name: The specific product name in 1-3 words. "Pressroom Theme" (since it's a WordPress theme, maybe "Pressroom WordPress Theme" or just "Pressroom"? Brief: "Pressroom Theme" but "Pressroom - News Magazine WordPress Theme" is the full name. The EUVD says: "Pressroom - News Magazine WordPress Theme n/a ≤6.9". So I'll use "Pressroom Theme". Keep it concise: "Pressroom WordPress Theme" (3 words). The vulnerability is in the theme, so product name: "Pressroom Theme". - summary: 2-3 sentences, original synthesis, not copy description. Start with impact verb and product. "Reflected cross-site scripting in the Pressroom WordPress theme through version 6.9 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL." Mention affected product (theme, versions). Note that exploitation requires user interaction (UI:R in CVSS vector). Actively exploited? No KEV, no POC mentioned. EPSS low 0.03%, so not high. So summary: "Reflected cross-site scripting in the Pressroom WordPress theme through version 6.9 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they click a malicious link. Successful exploitation could lead to session hijacking, defacement, or sensitive data exposure." Not exploited actively, no known POC. - technical_context: Underlying technology: WordPress theme, PHP, reflected XSS due to improper output escaping (CWE-79). CVE description says "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" so reflected XSS. CWE-79. The affected product is a WordPress theme. How
Reflected cross-site scripting in the Homey WordPress theme (versions ≤2.4.5) allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability has a CVSS score of 7.1 (High) but an EPSS probability of 0.03%, indicating minimal exploitation likelihood; no active exploitation or public exploit code has been reported.
Reflected Cross-Site Scripting (XSS) in the SB Breadcrumbs WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL, potentially hijacking user sessions, defacing the site, or redirecting visitors to malicious pages. No active exploitation or public exploit code has been identified at this time.
Reflected cross-site scripting (XSS) in WP Wall ≤1.7.3 lets attackers execute arbitrary JavaScript in victims' browsers via crafted links. The WordPress plugin fails to properly sanitize reflected input, requiring user interaction. No active exploitation or public exploit is confirmed, and EPSS probability is very low (0.03%).
Reflected cross-site scripting in the OTWthemes Content Manager Light WordPress plugin through version 3.2 allows an unauthenticated attacker to inject arbitrary web scripts. Successful exploitation requires tricking an authenticated administrator into clicking a crafted link, after which the attacker may steal session tokens, deface content, or perform other actions in the victim’s browser context. At the time of analysis, no public exploit code or active exploitation has been identified.
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT which is 17. But later echo_skb_max is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit function has actually caught the same thing earlier. BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0 CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dump_stack_lvl lib/dump_stack.c:122 print_report mm/kasan/report.c:521 kasan_report mm/kasan/report.c:634 kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528 kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605 kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656 kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684 kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733 __handle_irq_event_percpu kernel/irq/handle.c:158 handle_irq_event kernel/irq/handle.c:210 handle_edge_irq kernel/irq/chip.c:833 __common_interrupt arch/x86/kernel/irq.c:296 common_interrupt arch/x86/kernel/irq.c:286 </IRQ> Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echo_skb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be. Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
In the Linux kernel, the following vulnerability has been resolved: ext4: fix out of bounds punch offset Punching a hole with a start offset that exceeds max_end is not permitted and will result in a negative length in the truncate_inode_partial_folio() function while truncating the page cache, potentially leading to undesirable consequences. A simple reproducer: truncate -s 9895604649994 /mnt/foo xfs_io -c "pwrite 8796093022208 4096" /mnt/foo xfs_io -c "fpunch 8796093022213 25769803777" /mnt/foo kernel BUG at include/linux/highmem.h:275! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 710 Comm: xfs_io Not tainted 6.15.0-rc3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:zero_user_segments.constprop.0+0xd7/0x110 RSP: 0018:ffffc90001cf3b38 EFLAGS: 00010287 RAX: 0000000000000005 RBX: ffffea0001485e40 RCX: 0000000000001000 RDX: 000000000040b000 RSI: 0000000000000005 RDI: 000000000040b000 RBP: 000000000040affb R08: ffff888000000000 R09: ffffea0000000000 R10: 0000000000000003 R11: 00000000fffc7fc5 R12: 0000000000000005 R13: 000000000040affb R14: ffffea0001485e40 R15: ffff888031cd3000 FS: 00007f4f63d0b780(0000) GS:ffff8880d337d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000001ae0b038 CR3: 00000000536aa000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> truncate_inode_partial_folio+0x3dd/0x620 truncate_inode_pages_range+0x226/0x720 ? bdev_getblk+0x52/0x3e0 ? ext4_get_group_desc+0x78/0x150 ? crc32c_arch+0xfd/0x180 ? __ext4_get_inode_loc+0x18c/0x840 ? ext4_inode_csum+0x117/0x160 ? jbd2_journal_dirty_metadata+0x61/0x390 ? __ext4_handle_dirty_metadata+0xa0/0x2b0 ? kmem_cache_free+0x90/0x5a0 ? jbd2_journal_stop+0x1d5/0x550 ? __ext4_journal_stop+0x49/0x100 truncate_pagecache_range+0x50/0x80 ext4_truncate_page_cache_block_range+0x57/0x3a0 ext4_punch_hole+0x1fe/0x670 ext4_fallocate+0x792/0x17d0 ? __count_memcg_events+0x175/0x2a0 vfs_fallocate+0x121/0x560 ksys_fallocate+0x51/0xc0 __x64_sys_fallocate+0x24/0x40 x64_sys_call+0x18d2/0x4170 do_syscall_64+0xa7/0x220 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix this by filtering out cases where the punching start offset exceeds max_end.
CVE-2025-6056 is a security vulnerability (CVSS 6.9) that allows unauthenticated attackers. Remediation should follow standard vulnerability management procedures.
Path traversal in DynamiApps Frontend Admin (WordPress plugin) up to version 3.28.7 allows an authenticated high-privileged attacker to read arbitrary files on the server, leading to exposure of sensitive information. No public exploit is known, and EPSS score suggests low exploitation likelihood.
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exports_proc As of now nfsd calls create_proc_exports_entry() at start of init_nfsd and cleanup by remove_proc_entry() at last of...
A security vulnerability in A flaw (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Missing authorization in Gnuget MF Plus WPML plugin versions up to 1.1 allows unauthenticated attackers to modify settings. The vulnerability has a CVSS base score of 6.5, affecting integrity and availability without confidentiality impact, but no active exploitation is known and EPSS score (0.06%) indicates a low probability of real-world attacks.
Unauthorized settings modification in WC Pickup Store (WordPress plugin by Keylor Mendoza) versions up to 1.8.9 allows unauthenticated attackers to alter plugin configuration, potentially disrupting pickup store operations. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS probability is very low (0.06%).
A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.
A security vulnerability in Missing Authorization vulnerability in vgwort VG WORT METIS (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Authenticated attackers with low privileges can exploit missing authorization checks in Paytiko for WooCommerce versions up to 1.3.14 to modify plugin data, leading to high integrity impact but no confidentiality or availability loss. The vulnerability, classified as CWE-862, has
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.