Instruction: Please provide detailed information about CVE-2025-24450

CVE:CVE-2025-24450
Description:Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.840


Instruction: Please provide detailed information about CVE-2025-24451

CVE:CVE-2025-24451
Description:Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.993


Instruction: Please provide detailed information about CVE-2025-24452

CVE:CVE-2025-24452
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:32.140


Instruction: Please provide detailed information about CVE-2025-24453

CVE:CVE-2025-24453
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:32.297


Instruction: Please provide detailed information about CVE-2025-25748

CVE:CVE-2025-25748
Description:A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.
published:2025-03-11T18:15:32.810


Instruction: Please provide detailed information about CVE-2025-25749

CVE:CVE-2025-25749
Description:An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.
published:2025-03-11T18:15:32.933


Instruction: Please provide detailed information about CVE-2025-26701

CVE:CVE-2025-26701
Description:An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.
published:2025-03-11T18:15:33.210


Instruction: Please provide detailed information about CVE-2025-27158

CVE:CVE-2025-27158
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:33.540


Instruction: Please provide detailed information about CVE-2025-27159

CVE:CVE-2025-27159
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:33.687


Instruction: Please provide detailed information about CVE-2025-27160

CVE:CVE-2025-27160
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:33.840


Instruction: Please provide detailed information about CVE-2025-27161

CVE:CVE-2025-27161
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:33.993


Instruction: Please provide detailed information about CVE-2025-27162

CVE:CVE-2025-27162
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:34.150


Instruction: Please provide detailed information about CVE-2025-27163

CVE:CVE-2025-27163
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:34.293


Instruction: Please provide detailed information about CVE-2025-27164

CVE:CVE-2025-27164
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:34.437


Instruction: Please provide detailed information about CVE-2025-27166

CVE:CVE-2025-27166
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:34.580


Instruction: Please provide detailed information about CVE-2025-27167

CVE:CVE-2025-27167
Description:Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.
published:2025-03-11T18:15:34.730


Instruction: Please provide detailed information about CVE-2025-27168

CVE:CVE-2025-27168
Description:Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:34.893


Instruction: Please provide detailed information about CVE-2025-27169

CVE:CVE-2025-27169
Description:Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:35.077


Instruction: Please provide detailed information about CVE-2025-27170

CVE:CVE-2025-27170
Description:Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:35.227


Instruction: Please provide detailed information about CVE-2025-27171

CVE:CVE-2025-27171
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:35.377


Instruction: Please provide detailed information about CVE-2025-27174

CVE:CVE-2025-27174
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:35.600


Instruction: Please provide detailed information about CVE-2025-27175

CVE:CVE-2025-27175
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:35.743


Instruction: Please provide detailed information about CVE-2025-27176

CVE:CVE-2025-27176
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:35.897


Instruction: Please provide detailed information about CVE-2025-27177

CVE:CVE-2025-27177
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:36.047


Instruction: Please provide detailed information about CVE-2025-27178

CVE:CVE-2025-27178
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:36.200


Instruction: Please provide detailed information about CVE-2025-27179

CVE:CVE-2025-27179
Description:InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:36.353


Instruction: Please provide detailed information about CVE-2025-27439

CVE:CVE-2025-27439
Description:Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
published:2025-03-11T18:15:36.510


Instruction: Please provide detailed information about CVE-2025-27440

CVE:CVE-2025-27440
Description:Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
published:2025-03-11T18:15:36.653


Instruction: Please provide detailed information about CVE-2025-27591

CVE:CVE-2025-27591
Description:A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
published:2025-03-11T19:15:43.390


Instruction: Please provide detailed information about CVE-2025-27773

CVE:CVE-2025-27773
Description:The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
published:2025-03-11T19:15:43.677


Instruction: Please provide detailed information about CVE-2025-23242

CVE:CVE-2025-23242
Description:NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, or information disclosure.
published:2025-03-11T20:15:16.280


Instruction: Please provide detailed information about CVE-2025-23243

CVE:CVE-2025-23243
Description:NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service.
published:2025-03-11T20:15:16.463


Instruction: Please provide detailed information about CVE-2025-23360

CVE:CVE-2025-23360
Description:NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this vulnerability may lead to code execution and data tampering.
published:2025-03-11T20:15:16.633


Instruction: Please provide detailed information about CVE-2025-25925

CVE:CVE-2025-25925
Description:A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form.
published:2025-03-11T20:15:16.917


Instruction: Please provide detailed information about CVE-2025-25927

CVE:CVE-2025-25927
Description:A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request.
published:2025-03-11T20:15:17.050


Instruction: Please provide detailed information about CVE-2025-25928

CVE:CVE-2025-25928
Description:A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.
published:2025-03-11T20:15:17.247


Instruction: Please provide detailed information about CVE-2025-25929

CVE:CVE-2025-25929
Description:A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter.
published:2025-03-11T20:15:17.377


Instruction: Please provide detailed information about CVE-2025-27789

CVE:CVE-2025-27789
Description:Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
published:2025-03-11T20:15:18.330


Instruction: Please provide detailed information about CVE-2025-2206

CVE:CVE-2025-2206
Description:A vulnerability classified as problematic has been found in aitangbao springboot-manager 3.0. This affects an unknown part of the file /sys/permission. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T20:15:18.487


Instruction: Please provide detailed information about CVE-2025-2207

CVE:CVE-2025-2207
Description:A vulnerability classified as problematic was found in aitangbao springboot-manager 3.0. This vulnerability affects unknown code of the file /sys/dept. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T20:15:18.690


Instruction: Please provide detailed information about CVE-2025-0900

CVE:CVE-2025-0900
Description:PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25368.
published:2025-03-11T21:15:41.887


Instruction: Please provide detailed information about CVE-2025-21170

CVE:CVE-2025-21170
Description:Substance3D - Modeler versions 1.15.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T21:15:42.150


Instruction: Please provide detailed information about CVE-2025-27173

CVE:CVE-2025-27173
Description:Substance3D - Modeler versions 1.15.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T21:15:42.307


Instruction: Please provide detailed information about CVE-2025-27180

CVE:CVE-2025-27180
Description:Substance3D - Modeler versions 1.15.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T21:15:42.463


Instruction: Please provide detailed information about CVE-2025-27181

CVE:CVE-2025-27181
Description:Substance3D - Modeler versions 1.15.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T21:15:42.613


Instruction: Please provide detailed information about CVE-2025-28856

CVE:CVE-2025-28856
Description:Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats allows Cross Site Request Forgery. This issue affects W3Counter Free Real-Time Web Stats: from n/a through 4.1.
published:2025-03-11T21:15:42.763


Instruction: Please provide detailed information about CVE-2025-28857

CVE:CVE-2025-28857
Description:Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration allows Stored XSS. This issue affects Rankchecker.io Integration: from n/a through 1.0.9.
published:2025-03-11T21:15:42.903


Instruction: Please provide detailed information about CVE-2025-28859

CVE:CVE-2025-28859
Description:Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice allows Cross Site Request Forgery. This issue affects Maintenance Notice: from n/a through 1.0.5.
published:2025-03-11T21:15:43.050


Instruction: Please provide detailed information about CVE-2025-28860

CVE:CVE-2025-28860
Description:Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator allows Stored XSS. This issue affects Google News Editors Picks Feed Generator: from n/a through 2.1.
published:2025-03-11T21:15:43.193


Instruction: Please provide detailed information about CVE-2025-28861

CVE:CVE-2025-28861
Description:Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker allows Stored XSS. This issue affects WP jQuery Persian Datepicker: from n/a through 0.1.0.
published:2025-03-11T21:15:43.337


Instruction: Please provide detailed information about CVE-2025-28862

CVE:CVE-2025-28862
Description:Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover allows Cross Site Request Forgery. This issue affects Comment Date and Gravatar remover: from n/a through 1.0.
published:2025-03-11T21:15:43.490


Instruction: Please provide detailed information about CVE-2025-28863

CVE:CVE-2025-28863
Description:Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image allows Cross Site Request Forgery. This issue affects Delete Original Image: from n/a through 0.4.
published:2025-03-11T21:15:43.647


Instruction: Please provide detailed information about CVE-2025-28864

CVE:CVE-2025-28864
Description:Cross-Site Request Forgery (CSRF) vulnerability in Planet Studio Builder for Contact Form 7 by Webconstruct allows Cross Site Request Forgery. This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through 1.2.2.
published:2025-03-11T21:15:43.810


Instruction: Please provide detailed information about CVE-2025-28866

CVE:CVE-2025-28866
Description:Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger allows Cross Site Request Forgery. This issue affects Login Logger: from n/a through 1.2.1.
published:2025-03-11T21:15:43.970


Instruction: Please provide detailed information about CVE-2025-28867

CVE:CVE-2025-28867
Description:Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter allows Cross Site Request Forgery. This issue affects Frontpage category filter: from n/a through 1.0.2.
published:2025-03-11T21:15:44.127


Instruction: Please provide detailed information about CVE-2025-28868

CVE:CVE-2025-28868
Description:Cross-Site Request Forgery (CSRF) vulnerability in ZipList ZipList Recipe allows Cross Site Request Forgery. This issue affects ZipList Recipe: from n/a through 3.1.
published:2025-03-11T21:15:44.283


Instruction: Please provide detailed information about CVE-2025-28870

CVE:CVE-2025-28870
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm allows DOM-Based XSS. This issue affects amoCRM WebForm: from n/a through 1.1.
published:2025-03-11T21:15:44.440


Instruction: Please provide detailed information about CVE-2025-28871

CVE:CVE-2025-28871
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded allows Stored XSS. This issue affects Block Spam By Math Reloaded: from n/a through 2.2.4.
published:2025-03-11T21:15:44.600


Instruction: Please provide detailed information about CVE-2025-28872

CVE:CVE-2025-28872
Description:Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Block Spam By Math Reloaded: from n/a through 2.2.4.
published:2025-03-11T21:15:44.757


Instruction: Please provide detailed information about CVE-2025-28874

CVE:CVE-2025-28874
Description:Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email Assign Templates: from n/a through 1.6.
published:2025-03-11T21:15:44.907


Instruction: Please provide detailed information about CVE-2025-28875

CVE:CVE-2025-28875
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates allows Stored XSS. This issue affects BP Email Assign Templates: from n/a through 1.6.
published:2025-03-11T21:15:45.053


Instruction: Please provide detailed information about CVE-2025-28876

CVE:CVE-2025-28876
Description:Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official allows Cross Site Request Forgery. This issue affects Skrill Official: from n/a through 1.0.65.
published:2025-03-11T21:15:45.200


Instruction: Please provide detailed information about CVE-2025-28878

CVE:CVE-2025-28878
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys allows Stored XSS. This issue affects Awesome Surveys: from n/a through 2.0.10.
published:2025-03-11T21:15:45.353


Instruction: Please provide detailed information about CVE-2025-28879

CVE:CVE-2025-28879
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider allows Stored XSS. This issue affects Bee Layer Slider: from n/a through 1.1.
published:2025-03-11T21:15:45.507


Instruction: Please provide detailed information about CVE-2025-28881

CVE:CVE-2025-28881
Description:Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes allows Cross Site Request Forgery. This issue affects Mobile Themes: from n/a through 1.1.1.
published:2025-03-11T21:15:45.647


Instruction: Please provide detailed information about CVE-2025-28883

CVE:CVE-2025-28883
Description:Cross-Site Request Forgery (CSRF) vulnerability in Martin WP Compare Tables allows Stored XSS. This issue affects WP Compare Tables: from n/a through 1.0.5.
published:2025-03-11T21:15:45.803


Instruction: Please provide detailed information about CVE-2025-28884

CVE:CVE-2025-28884
Description:Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Kumar WP Bulk Post Duplicator allows Cross Site Request Forgery. This issue affects WP Bulk Post Duplicator: from n/a through 1.2.
published:2025-03-11T21:15:45.960


Instruction: Please provide detailed information about CVE-2025-28886

CVE:CVE-2025-28886
Description:Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram allows Cross Site Request Forgery. This issue affects REST API TO MiniProgram: from n/a through 4.7.1.
published:2025-03-11T21:15:46.113


Instruction: Please provide detailed information about CVE-2025-28887

CVE:CVE-2025-28887
Description:Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column allows Cross Site Request Forgery. This issue affects Plugins Last Updated Column: from n/a through 0.1.3.
published:2025-03-11T21:15:46.270


Instruction: Please provide detailed information about CVE-2025-28891

CVE:CVE-2025-28891
Description:Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc allows Stored XSS. This issue affects price-calc: from n/a through 0.6.3.
published:2025-03-11T21:15:46.420


Instruction: Please provide detailed information about CVE-2025-28892

CVE:CVE-2025-28892
Description:Cross-Site Request Forgery (CSRF) vulnerability in a2rocklobster FTP Sync allows Stored XSS. This issue affects FTP Sync: from n/a through 1.1.6.
published:2025-03-11T21:15:46.570


Instruction: Please provide detailed information about CVE-2025-28894

CVE:CVE-2025-28894
Description:Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress allows Stored XSS. This issue affects List of Posts from each Category plugin for WordPress: from n/a through 2.0.
published:2025-03-11T21:15:46.723


Instruction: Please provide detailed information about CVE-2025-28895

CVE:CVE-2025-28895
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sumanbiswas013 Custom top bar allows Stored XSS. This issue affects Custom top bar: from n/a through 2.0.2.
published:2025-03-11T21:15:46.873


Instruction: Please provide detailed information about CVE-2025-28896

CVE:CVE-2025-28896
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin allows Phishing. This issue affects AS English Admin: from n/a through 1.0.0.
published:2025-03-11T21:15:47.010


Instruction: Please provide detailed information about CVE-2025-28897

CVE:CVE-2025-28897
Description:Cross-Site Request Forgery (CSRF) vulnerability in Steveorevo Domain Theme allows Stored XSS. This issue affects Domain Theme: from n/a through 1.3.
published:2025-03-11T21:15:47.163


Instruction: Please provide detailed information about CVE-2025-28900

CVE:CVE-2025-28900
Description:Cross-Site Request Forgery (CSRF) vulnerability in webgarb TabGarb Pro allows Stored XSS. This issue affects TabGarb Pro: from n/a through 2.6.
published:2025-03-11T21:15:47.313


Instruction: Please provide detailed information about CVE-2025-28901

CVE:CVE-2025-28901
Description:Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users allows Stored XSS. This issue affects Members page only for logged in users: from n/a through 1.4.2.
published:2025-03-11T21:15:47.470


Instruction: Please provide detailed information about CVE-2025-28902

CVE:CVE-2025-28902
Description:Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button allows Cross Site Request Forgery. This issue affects Contact Form 7 Select Box Editor Button: from n/a through 0.6.
published:2025-03-11T21:15:47.627


Instruction: Please provide detailed information about CVE-2025-28905

CVE:CVE-2025-28905
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaser324 Featured Posts Grid allows Stored XSS. This issue affects Featured Posts Grid: from n/a through 1.7.
published:2025-03-11T21:15:47.780


Instruction: Please provide detailed information about CVE-2025-28906

CVE:CVE-2025-28906
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow allows Stored XSS. This issue affects Skitter Slideshow: from n/a through 2.5.2.
published:2025-03-11T21:15:47.933


Instruction: Please provide detailed information about CVE-2025-28907

CVE:CVE-2025-28907
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahul Arora WP Last Modified allows Stored XSS. This issue affects WP Last Modified: from n/a through 0.1.
published:2025-03-11T21:15:48.080


Instruction: Please provide detailed information about CVE-2025-28908

CVE:CVE-2025-28908
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pipdig pipDisqus allows Stored XSS. This issue affects pipDisqus: from n/a through 1.6.
published:2025-03-11T21:15:48.230


Instruction: Please provide detailed information about CVE-2025-28909

CVE:CVE-2025-28909
Description:Cross-Site Request Forgery (CSRF) vulnerability in edwardw WP No-Bot Question allows Cross Site Request Forgery. This issue affects WP No-Bot Question: from n/a through 0.1.7.
published:2025-03-11T21:15:48.383


Instruction: Please provide detailed information about CVE-2025-28910

CVE:CVE-2025-28910
Description:Cross-Site Request Forgery (CSRF) vulnerability in Ravinder Khurana WP Hide Admin Bar allows Cross Site Request Forgery. This issue affects WP Hide Admin Bar: from n/a through 2.0.
published:2025-03-11T21:15:48.650


Instruction: Please provide detailed information about CVE-2025-28912

CVE:CVE-2025-28912
Description:Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page allows Cross Site Request Forgery. This issue affects Custom Dashboard Page: from n/a through 1.0.
published:2025-03-11T21:15:48.833


Instruction: Please provide detailed information about CVE-2025-28913

CVE:CVE-2025-28913
Description:Cross-Site Request Forgery (CSRF) vulnerability in Aftab Ali Muni WP Add Active Class To Menu Item allows Cross Site Request Forgery. This issue affects WP Add Active Class To Menu Item: from n/a through 1.0.
published:2025-03-11T21:15:49.010


Instruction: Please provide detailed information about CVE-2025-28914

CVE:CVE-2025-28914
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Sharma wordpress login form to anywhere allows Stored XSS. This issue affects wordpress login form to anywhere: from n/a through 0.2.
published:2025-03-11T21:15:49.173


Instruction: Please provide detailed information about CVE-2025-28915

CVE:CVE-2025-28915
Description:Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit allows Upload a Web Shell to a Web Server. This issue affects ThemeEgg ToolKit: from n/a through 1.2.9.
published:2025-03-11T21:15:49.323


Instruction: Please provide detailed information about CVE-2025-28918

CVE:CVE-2025-28918
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones Featured Image Thumbnail Grid allows Stored XSS. This issue affects Featured Image Thumbnail Grid: from n/a through 6.6.1.
published:2025-03-11T21:15:49.477


Instruction: Please provide detailed information about CVE-2025-28919

CVE:CVE-2025-28919
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shellbot Easy Image Display allows Stored XSS. This issue affects Easy Image Display: from n/a through 1.2.5.
published:2025-03-11T21:15:49.623


Instruction: Please provide detailed information about CVE-2025-28920

CVE:CVE-2025-28920
Description:Missing Authorization vulnerability in Jogesh Responsive Google Map allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Responsive Google Map: from n/a through 3.1.5.
published:2025-03-11T21:15:49.780


Instruction: Please provide detailed information about CVE-2025-28922

CVE:CVE-2025-28922
Description:Cross-Site Request Forgery (CSRF) vulnerability in Terence D. Go To Top allows Stored XSS. This issue affects Go To Top: from n/a through 0.0.8.
published:2025-03-11T21:15:49.930


Instruction: Please provide detailed information about CVE-2025-28923

CVE:CVE-2025-28923
Description:Cross-Site Request Forgery (CSRF) vulnerability in philippe No Disposable Email allows Stored XSS. This issue affects No Disposable Email: from n/a through 2.5.1.
published:2025-03-11T21:15:50.087


Instruction: Please provide detailed information about CVE-2025-28925

CVE:CVE-2025-28925
Description:Cross-Site Request Forgery (CSRF) vulnerability in Hieu Nguyen WATI Chat and Notification allows Stored XSS. This issue affects WATI Chat and Notification: from n/a through 1.1.2.
published:2025-03-11T21:15:50.240


Instruction: Please provide detailed information about CVE-2025-28926

CVE:CVE-2025-28926
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in popeating Post Read Time allows Stored XSS. This issue affects Post Read Time: from n/a through 1.2.6.
published:2025-03-11T21:15:50.397


Instruction: Please provide detailed information about CVE-2025-28927

CVE:CVE-2025-28927
Description:Cross-Site Request Forgery (CSRF) vulnerability in A. Chappard Display Template Name allows Cross Site Request Forgery. This issue affects Display Template Name: from n/a through 1.7.1.
published:2025-03-11T21:15:50.547


Instruction: Please provide detailed information about CVE-2025-28929

CVE:CVE-2025-28929
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vivek Marakana Tabbed Login Widget allows Stored XSS. This issue affects Tabbed Login Widget: from n/a through 1.1.2.
published:2025-03-11T21:15:50.690


Instruction: Please provide detailed information about CVE-2025-28930

CVE:CVE-2025-28930
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodolphe MOULIN List Mixcloud allows Stored XSS. This issue affects List Mixcloud: from n/a through 1.4.
published:2025-03-11T21:15:50.847


Instruction: Please provide detailed information about CVE-2025-28931

CVE:CVE-2025-28931
Description:Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags allows Stored XSS. This issue affects Hashtags: from n/a through 0.3.2.
published:2025-03-11T21:15:51.000


Instruction: Please provide detailed information about CVE-2025-28932

CVE:CVE-2025-28932
Description:Cross-Site Request Forgery (CSRF) vulnerability in BCS Website Solutions Insert Code allows Stored XSS. This issue affects Insert Code: from n/a through 2.4.
published:2025-03-11T21:15:51.150


Instruction: Please provide detailed information about CVE-2025-28933

CVE:CVE-2025-28933
Description:Cross-Site Request Forgery (CSRF) vulnerability in maxfoundry MaxA/B allows Stored XSS. This issue affects MaxA/B: from n/a through 2.2.2.
published:2025-03-11T21:15:51.290


Instruction: Please provide detailed information about CVE-2025-28936

CVE:CVE-2025-28936
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sakurapixel Lunar allows Stored XSS. This issue affects Lunar: from n/a through 1.3.0.
published:2025-03-11T21:15:51.443


Instruction: Please provide detailed information about CVE-2025-28937

CVE:CVE-2025-28937
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search allows Stored XSS. This issue affects Lava Ajax Search: from n/a through 1.1.9.
published:2025-03-11T21:15:51.587


Instruction: Please provide detailed information about CVE-2025-28938

CVE:CVE-2025-28938
Description:Missing Authorization vulnerability in Bjoern WP Performance Pack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Performance Pack: from n/a through 2.5.3.
published:2025-03-11T21:15:51.737


Instruction: Please provide detailed information about CVE-2025-28940

CVE:CVE-2025-28940
Description:Cross-Site Request Forgery (CSRF) vulnerability in arkapravamajumder Back To Top allows Cross Site Request Forgery. This issue affects Back To Top: from n/a through 2.0.
published:2025-03-11T21:15:51.887


Instruction: Please provide detailed information about CVE-2025-28941

CVE:CVE-2025-28941
Description:Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye allows Cross Site Request Forgery. This issue affects Spam Byebye: from n/a through 2.2.4.
published:2025-03-11T21:15:52.030


Instruction: Please provide detailed information about CVE-2025-28943

CVE:CVE-2025-28943
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager allows Stored XSS. This issue affects DP ALTerminator - Missing ALT manager: from n/a through 1.0.2.
published:2025-03-11T21:15:52.187


Instruction: Please provide detailed information about CVE-2025-2012

CVE:CVE-2025-2012
Description:Ashlar-Vellum Cobalt VS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25185.
published:2025-03-11T21:15:52.333


Instruction: Please provide detailed information about CVE-2025-2013

CVE:CVE-2025-2013
Description:Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of CO files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25186.
published:2025-03-11T21:15:52.473


Instruction: Please provide detailed information about CVE-2025-2014

CVE:CVE-2025-2014
Description:Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VS files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25235.
published:2025-03-11T21:15:52.613


Instruction: Please provide detailed information about CVE-2025-2015

CVE:CVE-2025-2015
Description:Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25236.
published:2025-03-11T21:15:52.763


Instruction: Please provide detailed information about CVE-2025-2016

CVE:CVE-2025-2016
Description:Ashlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25238.
published:2025-03-11T21:15:52.903


Instruction: Please provide detailed information about CVE-2025-2017

CVE:CVE-2025-2017
Description:Ashlar-Vellum Cobalt CO File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25240.
published:2025-03-11T21:15:53.050


Instruction: Please provide detailed information about CVE-2025-2018

CVE:CVE-2025-2018
Description:Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25245.
published:2025-03-11T21:15:53.197


Instruction: Please provide detailed information about CVE-2025-2019

CVE:CVE-2025-2019
Description:Ashlar-Vellum Cobalt VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25252.
published:2025-03-11T21:15:53.337


Instruction: Please provide detailed information about CVE-2025-2020

CVE:CVE-2025-2020
Description:Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25254.
published:2025-03-11T21:15:53.477


Instruction: Please provide detailed information about CVE-2025-2021

CVE:CVE-2025-2021
Description:Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25264.
published:2025-03-11T21:15:53.613


Instruction: Please provide detailed information about CVE-2025-2022

CVE:CVE-2025-2022
Description:Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25276.
published:2025-03-11T21:15:53.750


Instruction: Please provide detailed information about CVE-2025-2023

CVE:CVE-2025-2023
Description:Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25348.
published:2025-03-11T21:15:53.890


Instruction: Please provide detailed information about CVE-2025-2208

CVE:CVE-2025-2208
Description:A vulnerability, which was classified as problematic, has been found in aitangbao springboot-manager 3.0. This issue affects some unknown processing of the file /sysFiles/upload of the component Filename Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T21:15:54.117


Instruction: Please provide detailed information about CVE-2025-1707

CVE:CVE-2025-1707
Description:The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
published:2025-03-11T22:15:12.583


Instruction: Please provide detailed information about CVE-2025-27101

CVE:CVE-2025-27101
Description:Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of the application are impacted, as this is exploitable by any user to reveal all files in the opal filesystem. This also means that low-privilege users such as DataShield users can retrieve the files of other users. Version 5.1.1 contains a patch for the issue.
published:2025-03-11T22:15:13.390


Instruction: Please provide detailed information about CVE-2025-27792

CVE:CVE-2025-27792
Description:Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using `<meta name="referrer" content="never">`, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue.
published:2025-03-11T22:15:13.567


Instruction: Please provide detailed information about CVE-2025-2209

CVE:CVE-2025-2209
Description:A vulnerability, which was classified as problematic, was found in aitangbao springboot-manager 3.0. Affected is an unknown function of the file /sysDict/add. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T22:15:13.713


Instruction: Please provide detailed information about CVE-2025-2210

CVE:CVE-2025-2210
Description:A vulnerability has been found in aitangbao springboot-manager 3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /sysJob/add. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T22:15:13.893


Instruction: Please provide detailed information about CVE-2025-2211

CVE:CVE-2025-2211
Description:A vulnerability was found in aitangbao springboot-manager 3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /sysDictDetail/add. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T22:15:14.080


Instruction: Please provide detailed information about CVE-2025-2212

CVE:CVE-2025-2212
Description:A vulnerability was found in Castlenet CBW383G2N up to 20250301. It has been classified as problematic. This affects an unknown part of the file /RgSwInfo.asp. The manipulation of the argument Description with the input <img/src/onerror=prompt(8)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T23:15:38.253


Instruction: Please provide detailed information about CVE-2025-2213

CVE:CVE-2025-2213
Description:A vulnerability was found in Castlenet CBW383G2N up to 20250301. It has been declared as problematic. This vulnerability affects unknown code of the file /wlanPrimaryNetwork.asp of the component Wireless Menu. The manipulation of the argument SSID with the input <img/src/onerror=prompt(8)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T23:15:38.430


Instruction: Please provide detailed information about CVE-2025-2233

CVE:CVE-2025-2233
Description:Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not required to exploit this vulnerability.  The specific flaw exists within the Hub Local API service, which listens on TCP port 8766 by default. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25615.
published:2025-03-11T23:15:38.610


Instruction: Please provide detailed information about CVE-2025-2214

CVE:CVE-2025-2214
Description:A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T00:15:11.770


Instruction: Please provide detailed information about CVE-2025-2215

CVE:CVE-2025-2215
Description:A vulnerability classified as critical was found in Doufox up to 0.2.0. Affected by this vulnerability is an unknown functionality of the file /?s=doudou&c=file&a=list. The manipulation of the argument dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T00:15:12.573


Instruction: Please provide detailed information about CVE-2025-2216

CVE:CVE-2025-2216
Description:A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function UploadCrash of the file /crash/log/SaveCrash.ashx. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T00:15:12.777


Instruction: Please provide detailed information about CVE-2025-2217

CVE:CVE-2025-2217
Description:A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 1.3. This affects the function ProcessRequest of the file /getAdyData.ashx. The manipulation of the argument showid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T00:15:13.023


Instruction: Please provide detailed information about CVE-2025-2218

CVE:CVE-2025-2218
Description:A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T01:15:35.700


Instruction: Please provide detailed information about CVE-2025-2219

CVE:CVE-2025-2219
Description:A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/image. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T01:15:35.893


Instruction: Please provide detailed information about CVE-2025-2220

CVE:CVE-2025-2220
Description:A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odyssey_contact_form/odyssey_contact_form.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key management error. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-12T02:15:19.300


Instruction: Please provide detailed information about CVE-2025-1508

CVE:CVE-2025-1508
Description:The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to download all of a site's post content when WooCommerce is installed.
published:2025-03-12T04:15:16.520


Instruction: Please provide detailed information about CVE-2025-2076

CVE:CVE-2025-2076
Description:The binlayerpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
published:2025-03-12T04:15:18.800


Instruction: Please provide detailed information about CVE-2025-2077

CVE:CVE-2025-2077
Description:The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-12T04:15:19.000


Instruction: Please provide detailed information about CVE-2025-2078

CVE:CVE-2025-2078
Description:The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
published:2025-03-12T04:15:19.210


Instruction: Please provide detailed information about CVE-2025-2205

CVE:CVE-2025-2205
Description:The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
published:2025-03-12T04:15:19.810


Instruction: Please provide detailed information about CVE-2025-24912

CVE:CVE-2025-24912
Description:hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.
published:2025-03-12T05:15:37.430


Instruction: Please provide detailed information about CVE-2025-21844

CVE:CVE-2025-21844
Description:In the Linux kernel, the following vulnerability has been resolved:  smb: client: Add check for next_buffer in receive_encrypted_standard()  Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference.
published:2025-03-12T10:15:16.677


Instruction: Please provide detailed information about CVE-2025-21845


Instruction: Please provide detailed information about CVE-2025-21846

CVE:CVE-2025-21846
Description:In the Linux kernel, the following vulnerability has been resolved:  acct: perform last write from workqueue  In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs.  Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk.  This api should stop to exist though.
published:2025-03-12T10:15:16.960


Instruction: Please provide detailed information about CVE-2025-21847

CVE:CVE-2025-21847
Description:In the Linux kernel, the following vulnerability has been resolved:  ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()  The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference.
published:2025-03-12T10:15:17.100


Instruction: Please provide detailed information about CVE-2025-21848

CVE:CVE-2025-21848
Description:In the Linux kernel, the following vulnerability has been resolved:  nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()  Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.
published:2025-03-12T10:15:17.230


Instruction: Please provide detailed information about CVE-2025-21849

CVE:CVE-2025-21849
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/i915/gt: Use spin_lock_irqsave() in interruptible context  spin_lock/unlock() functions used in interrupt contexts could result in a deadlock, as seen in GitLab issue #13399, which occurs when interrupt comes in while holding a lock.  Try to remedy the problem by saving irq state before spin lock acquisition.  v2: add irqs' state save/restore calls to all locks/unlocks in  signal_irq_work() execution (Maciej)  v3: use with spin_lock_irqsave() in guc_lrc_desc_unpin() instead  of other lock/unlock calls and add Fixes and Cc tags (Tvrtko);  change title and commit message  (cherry picked from commit c088387ddd6482b40f21ccf23db1125e8fa4af7e)
published:2025-03-12T10:15:17.367


Instruction: Please provide detailed information about CVE-2025-21850

CVE:CVE-2025-21850
Description:In the Linux kernel, the following vulnerability has been resolved:  nvmet: Fix crash when a namespace is disabled  The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running blktests/nvme/058 (eg for loop transport):  [ 2352.930426] [  T53909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI [ 2352.930431] [  T53909] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 2352.930434] [  T53909] CPU: 3 UID: 0 PID: 53909 Comm: kworker/u16:5 Tainted: G        W          6.13.0-rc6 #232 [ 2352.930438] [  T53909] Tainted: [W]=WARN [ 2352.930440] [  T53909] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 2352.930443] [  T53909] Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] [ 2352.930449] [  T53909] RIP: 0010:blkcg_set_ioprio+0x44/0x180  as the queue is already torn down when calling submit_bio();  So we need to init the percpu counter in nvmet_ns_enable(), and wait for it to drop to zero in nvmet_ns_disable() to avoid having I/O pending after the namespace has been disabled.
published:2025-03-12T10:15:17.507


Instruction: Please provide detailed information about CVE-2025-21851

CVE:CVE-2025-21851
Description:In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix softlockup in arena_map_free on 64k page kernel  On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64.  It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start().  If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup.  Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.
published:2025-03-12T10:15:17.703


Instruction: Please provide detailed information about CVE-2025-21852

CVE:CVE-2025-21852
Description:In the Linux kernel, the following vulnerability has been resolved:  net: Add rx_skb of kfree_skb to raw_tp_null_args[].  Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL.  Commit c53795d48ee8 ("net: add rx_sk to trace_kfree_skb") added rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL.  Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier validate such a prog and prevent the issue.  Now we fail to load such a prog:    libbpf: prog 'drop': -- BEGIN PROG LOAD LOG --   0: R1=ctx() R10=fp0   ; int BPF_PROG(drop, struct sk_buff *skb, void *location, @ kfree_skb_sk_null.bpf.c:21   0: (79) r3 = *(u64 *)(r1 +24)   func 'kfree_skb' arg3 has btf_id 5253 type STRUCT 'sock'   1: R1=ctx() R3_w=trusted_ptr_or_null_sock(id=1)   ; bpf_printk("sk: %d, %d\n", sk, sk->__sk_common.skc_family); @ kfree_skb_sk_null.bpf.c:24   1: (69) r4 = *(u16 *)(r3 +16)   R3 invalid mem access 'trusted_ptr_or_null_'   processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0   -- END PROG LOAD LOG --  Note this fix requires commit 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL").  [0]: BUG: kernel NULL pointer dereference, address: 0000000000000010  PF: supervisor read access in kernel mode  PF: error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP RIP: 0010:bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d Call Trace:  <TASK>  ? __die+0x1f/0x60  ? page_fault_oops+0x148/0x420  ? search_bpf_extables+0x5b/0x70  ? fixup_exception+0x27/0x2c0  ? exc_page_fault+0x75/0x170  ? asm_exc_page_fault+0x22/0x30  ? bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d  bpf_trace_run4+0x68/0xd0  ? unix_stream_connect+0x1f4/0x6f0  sk_skb_reason_drop+0x90/0x120  unix_stream_connect+0x1f4/0x6f0  __sys_connect+0x7f/0xb0  __x64_sys_connect+0x14/0x20  do_syscall_64+0x47/0xc30  entry_SYSCALL_64_after_hwframe+0x4b/0x53
published:2025-03-12T10:15:17.927


Instruction: Please provide detailed information about CVE-2025-21853

CVE:CVE-2025-21853
Description:In the Linux kernel, the following vulnerability has been resolved:  bpf: avoid holding freeze_mutex during mmap operation  We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we naively do this means we'll hold freeze_mutex for entire duration of all the mm and VMA manipulations, which is completely unnecessary. This can potentially also lead to deadlocks, as reported by syzbot in [0].  So, instead, hold freeze_mutex only during writeability checks, bump (proactively) "write active" count for the map, unlock the mutex and proceed with mmap logic. And only if something went wrong during mmap logic, then undo that "write active" counter increment.    [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/
published:2025-03-12T10:15:18.063


Instruction: Please provide detailed information about CVE-2025-21854

CVE:CVE-2025-21854
Description:In the Linux kernel, the following vulnerability has been resolved:  sockmap, vsock: For connectible sockets allow only connected  sockmap expects all vsocks to have a transport assigned, which is expressed in vsock_proto::psock_update_sk_prot(). However, there is an edge case where an unconnected (connectible) socket may lose its previously assigned transport. This is handled with a NULL check in the vsock/BPF recv path.  Another design detail is that listening vsocks are not supposed to have any transport assigned at all. Which implies they are not supported by the sockmap. But this is complicated by the fact that a socket, before switching to TCP_LISTEN, may have had some transport assigned during a failed connect() attempt. Hence, we may end up with a listening vsock in a sockmap, which blows up quickly:  KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+ Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_read_skb+0x4b/0x90 Call Trace:  sk_psock_verdict_data_ready+0xa4/0x2e0  virtio_transport_recv_pkt+0x1ca8/0x2acc  vsock_loopback_work+0x27d/0x3f0  process_one_work+0x846/0x1420  worker_thread+0x5b3/0xf80  kthread+0x35a/0x700  ret_from_fork+0x2d/0x70  ret_from_fork_asm+0x1a/0x30  For connectible sockets, instead of relying solely on the state of vsk->transport, tell sockmap to only allow those representing established connections. This aligns with the behaviour for AF_INET and AF_UNIX.
published:2025-03-12T10:15:18.190


Instruction: Please provide detailed information about CVE-2025-21855

CVE:CVE-2025-21855
Description:In the Linux kernel, the following vulnerability has been resolved:  ibmvnic: Don't reference skb after sending to VIOS  Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb.  It is invalid to access the skb memory after sending the buffer to the VIOS because, at any point after sending, the VIOS can trigger an interrupt to free this memory. A race between reading skb->len and freeing the skb is possible (especially during LPM) and will result in use-after-free:  ==================================================================  BUG: KASAN: slab-use-after-free in ibmvnic_xmit+0x75c/0x1808 [ibmvnic]  Read of size 4 at addr c00000024eb48a70 by task hxecom/14495  <...>  Call Trace:  [c000000118f66cf0] [c0000000018cba6c] dump_stack_lvl+0x84/0xe8 (unreliable)  [c000000118f66d20] [c0000000006f0080] print_report+0x1a8/0x7f0  [c000000118f66df0] [c0000000006f08f0] kasan_report+0x128/0x1f8  [c000000118f66f00] [c0000000006f2868] __asan_load4+0xac/0xe0  [c000000118f66f20] [c0080000046eac84] ibmvnic_xmit+0x75c/0x1808 [ibmvnic]  [c000000118f67340] [c0000000014be168] dev_hard_start_xmit+0x150/0x358  <...>  Freed by task 0:  kasan_save_stack+0x34/0x68  kasan_save_track+0x2c/0x50  kasan_save_free_info+0x64/0x108  __kasan_mempool_poison_object+0x148/0x2d4  napi_skb_cache_put+0x5c/0x194  net_tx_action+0x154/0x5b8  handle_softirqs+0x20c/0x60c  do_softirq_own_stack+0x6c/0x88  <...>  The buggy address belongs to the object at c00000024eb48a00 which   belongs to the cache skbuff_head_cache of size 224 ==================================================================
published:2025-03-12T10:15:18.320


Instruction: Please provide detailed information about CVE-2025-21856

CVE:CVE-2025-21856
Description:In the Linux kernel, the following vulnerability has been resolved:  s390/ism: add release function for struct device  According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed.  The current code directly frees the device after calling device_add() without waiting for other kernel parts to release their references. Thus, a reference could still be held to a struct device, e.g., by sysfs, leading to potential use-after-free issues if a proper release function is not set.
published:2025-03-12T10:15:18.453


Instruction: Please provide detailed information about CVE-2025-21857

CVE:CVE-2025-21857
Description:In the Linux kernel, the following vulnerability has been resolved:  net/sched: cls_api: fix error handling causing NULL dereference  tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to caller tcf_exts_init_ex() which sets exts->actions to NULL and returns 1 to caller fl_change().  fl_change() treats err == 1 as success, calling tcf_exts_validate_ex() which calls tcf_action_init() with exts->actions as argument, where it is dereferenced.  Example trace:  BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1 RIP: 0010:tcf_action_init+0x1f8/0x2c0 Call Trace:  tcf_action_init+0x1f8/0x2c0  tcf_exts_validate_ex+0x175/0x190  fl_change+0x537/0x1120 [cls_flower]
published:2025-03-12T10:15:18.583


Instruction: Please provide detailed information about CVE-2025-21858

CVE:CVE-2025-21858
Description:In the Linux kernel, the following vulnerability has been resolved:  geneve: Fix use-after-free in geneve_find_dev().  syzkaller reported a use-after-free in geneve_find_dev() [0] without repro.  geneve_configure() links struct geneve_dev.next to net_generic(net, geneve_net_id)->geneve_list.  The net here could differ from dev_net(dev) if IFLA_NET_NS_PID, IFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set.  When dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally calls unregister_netdevice_queue() for each dev in the netns, and later the dev is freed.  However, its geneve_dev.next is still linked to the backend UDP socket netns.  Then, use-after-free will occur when another geneve dev is created in the netns.  Let's call geneve_dellink() instead in geneve_destroy_tunnels().  [0]: BUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline] BUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 Read of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441  CPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d Hardware name: linux,dummy-virt (DT) Call trace:  show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C)  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120  print_address_description mm/kasan/report.c:378 [inline]  print_report+0x16c/0x6f0 mm/kasan/report.c:489  kasan_report+0xc0/0x120 mm/kasan/report.c:602  __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379  geneve_find_dev drivers/net/geneve.c:1295 [inline]  geneve_configure+0x234/0x858 drivers/net/geneve.c:1343  geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634  rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795  __rtnl_newlink net/core/rtnetlink.c:3906 [inline]  rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021  rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911  netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543  rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938  netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]  netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348  netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892  sock_sendmsg_nosec net/socket.c:713 [inline]  __sock_sendmsg net/socket.c:728 [inline]  ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568  ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622  __sys_sendmsg net/socket.c:2654 [inline]  __do_sys_sendmsg net/socket.c:2659 [inline]  __se_sys_sendmsg net/socket.c:2657 [inline]  __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]  invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49  el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132  do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151  el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744  el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762  el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600  Allocated by task 13247:  kasan_save_stack mm/kasan/common.c:47 [inline]  kasan_save_track+0x30/0x68 mm/kasan/common.c:68  kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]  __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394  kasan_kmalloc include/linux/kasan.h:260 [inline]  __do_kmalloc_node mm/slub.c:4298 [inline]  __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304  __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645  alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470  rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604  rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780  __rtnl_newlink net/core/rtnetlink.c:3906 [inline]  rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021  rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911  netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543  rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938  netlink_unicast_kernel net/netlink/af_n ---truncated---
published:2025-03-12T10:15:18.720


Instruction: Please provide detailed information about CVE-2025-21859

CVE:CVE-2025-21859
Description:In the Linux kernel, the following vulnerability has been resolved:  USB: gadget: f_midi: f_midi_complete to call queue_work  When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock.  Fix it by using queue_work() to schedule the inner f_midi_transmit() via a high priority work queue from the completion handler.
published:2025-03-12T10:15:18.853


Instruction: Please provide detailed information about CVE-2025-21860

CVE:CVE-2025-21860
Description:In the Linux kernel, the following vulnerability has been resolved:  mm/zswap: fix inconsistency when zswap_store_page() fails  Commit b7c0ccdfbafd ("mm: zswap: support large folios in zswap_store()") skips charging any zswap entries when it failed to zswap the entire folio.  However, when some base pages are zswapped but it failed to zswap the entire folio, the zswap operation is rolled back.  When freeing zswap entries for those pages, zswap_entry_free() uncharges the zswap entries that were not previously charged, causing zswap charging to become inconsistent.  This inconsistency triggers two warnings with following steps:   # On a machine with 64GiB of RAM and 36GiB of zswap   $ stress-ng --bigheap 2 # wait until the OOM-killer kills stress-ng   $ sudo reboot    The two warnings are:     in mm/memcontrol.c:163, function obj_cgroup_release():       WARN_ON_ONCE(nr_bytes & (PAGE_SIZE - 1));      in mm/page_counter.c:60, function page_counter_cancel():       if (WARN_ONCE(new < 0, "page_counter underflow: %ld nr_pages=%lu\n", 	  new, nr_pages))  zswap_stored_pages also becomes inconsistent in the same way.  As suggested by Kanchana, increment zswap_stored_pages and charge zswap entries within zswap_store_page() when it succeeds.  This way, zswap_entry_free() will decrement the counter and uncharge the entries when it failed to zswap the entire folio.  While this could potentially be optimized by batching objcg charging and incrementing the counter, let's focus on fixing the bug this time and leave the optimization for later after some evaluation.  After resolving the inconsistency, the warnings disappear.  [42.hyeyoo@gmail.com: refactor zswap_store_page()]   Link: https://lkml.kernel.org/r/20250131082037.2426-1-42.hyeyoo@gmail.com
published:2025-03-12T10:15:18.990


Instruction: Please provide detailed information about CVE-2025-21861

CVE:CVE-2025-21861
Description:In the Linux kernel, the following vulnerability has been resolved:  mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()  If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio.  This will set memcg_data of the old folio to 0.  Similarly, if migration failed, memcg_data of the dst folio is left unset.  If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy.  Running the hmm selftests:    # ./hmm-tests   ...   #  RUN           hmm.hmm_device_private.migrate ...   [  102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00   [  102.079974][T14893] anon flags: 0x17ff00000020018(uptodate|dirty|swapbacked|node=0|zone=2|lastcpupid=0x7ff)   [  102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9   [  102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000   [  102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled())   [  102.087230][T14893] ------------[ cut here ]------------   [  102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170   [  102.090478][T14893] Modules linked in:   [  102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151   [  102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014   [  102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170   [  102.096104][T14893] Code: ...   [  102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293   [  102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426   [  102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880   [  102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000   [  102.105757][T14893] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900236c37d8   [  102.107296][T14893] R13: ffff888277a2bcb0 R14: 000000000000001f R15: 0000000000000000   [  102.108830][T14893] FS:  00007ff27dbdd740(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000   [  102.110643][T14893] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   [  102.111924][T14893] CR2: 00007ff27d400000 CR3: 000000010866e000 CR4: 0000000000750ef0   [  102.113478][T14893] PKRU: 55555554   [  102.114172][T14893] Call Trace:   [  102.114805][T14893]  <TASK>   [  102.115397][T14893]  ? folio_lruvec_lock_irqsave+0x10e/0x170   [  102.116547][T14893]  ? __warn.cold+0x110/0x210   [  102.117461][T14893]  ? folio_lruvec_lock_irqsave+0x10e/0x170   [  102.118667][T14893]  ? report_bug+0x1b9/0x320   [  102.119571][T14893]  ? handle_bug+0x54/0x90   [  102.120494][T14893]  ? exc_invalid_op+0x17/0x50   [  102.121433][T14893]  ? asm_exc_invalid_op+0x1a/0x20   [  102.122435][T14893]  ? __wake_up_klogd.part.0+0x76/0xd0   [  102.123506][T14893]  ? dump_page+0x4f/0x60   [  102.124352][T14893]  ? folio_lruvec_lock_irqsave+0x10e/0x170   [  102.125500][T14893]  folio_batch_move_lru+0xd4/0x200   [  102.126577][T14893]  ? __pfx_lru_add+0x10/0x10   [  102.127505][T14893]  __folio_batch_add_and_move+0x391/0x720   [  102.128633][T14893]  ? __pfx_lru_add+0x10/0x10   [  102.129550][T14893]  folio_putback_lru+0x16/0x80   [  102.130564][T14893]  migrate_device_finalize+0x9b/0x530   [  102.131640][T14893]  dmirror_migrate_to_device.constprop.0+0x7c5/0xad0   [  102.133047][T14893]  dmirror_fops_unlocked_ioctl+0x89b/0xc80  Likely, nothing else goes wrong: putting the last folio reference will remove the folio from the LRU again.  So besides memcg complaining, adding the folio to be freed to the LRU is just an unnecessary step.  The new flow resembles what we have in migrate_folio_move(): add the dst to the lru, rem ---truncated---
published:2025-03-12T10:15:19.117


Instruction: Please provide detailed information about CVE-2025-21862

CVE:CVE-2025-21862
Description:In the Linux kernel, the following vulnerability has been resolved:  drop_monitor: fix incorrect initialization order  Syzkaller reports the following bug:  BUG: spinlock bad magic on CPU#1, syz-executor.0/7995  lock: 0xffff88805303f3e0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 CPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G            E     5.10.209+ #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace:  __dump_stack lib/dump_stack.c:77 [inline]  dump_stack+0x119/0x179 lib/dump_stack.c:118  debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]  do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]  _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159  reset_per_cpu_data+0xe6/0x240 [drop_monitor]  net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor]  genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739  genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]  genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800  netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497  genl_rcv+0x29/0x40 net/netlink/genetlink.c:811  netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]  netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348  netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916  sock_sendmsg_nosec net/socket.c:651 [inline]  __sock_sendmsg+0x157/0x190 net/socket.c:663  ____sys_sendmsg+0x712/0x870 net/socket.c:2378  ___sys_sendmsg+0xf8/0x170 net/socket.c:2432  __sys_sendmsg+0xea/0x1b0 net/socket.c:2461  do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46  entry_SYSCALL_64_after_hwframe+0x62/0xc7 RIP: 0033:0x7f3f9815aee9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f3f9826d050 RCX: 00007f3f9815aee9 RDX: 0000000020000000 RSI: 0000000020001300 RDI: 0000000000000007 RBP: 00007f3f981b63bd R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768  If drop_monitor is built as a kernel module, syzkaller may have time to send a netlink NET_DM_CMD_START message during the module loading. This will call the net_dm_monitor_start() function that uses a spinlock that has not yet been initialized.  To fix this, let's place resource initialization above the registration of a generic netlink family.  Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.
published:2025-03-12T10:15:19.253


Instruction: Please provide detailed information about CVE-2025-21863

CVE:CVE-2025-21863
Description:In the Linux kernel, the following vulnerability has been resolved:  io_uring: prevent opcode speculation  sqe->opcode is used for different tables, make sure we santitise it against speculations.
published:2025-03-12T10:15:19.387


Instruction: Please provide detailed information about CVE-2025-21864

CVE:CVE-2025-21864
Description:In the Linux kernel, the following vulnerability has been resolved:  tcp: drop secpath at the same time as we currently drop dst  Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to:  - create a pair of netns  - run a basic TCP test over ipcomp6  - delete the pair of netns  The xfrm_state found on spi_byaddr was not deleted at the time we delete the netns, because we still have a reference on it. This lingering reference comes from a secpath (which holds a ref on the xfrm_state), which is still attached to an skb. This skb is not leaked, it ends up on sk_receive_queue and then gets defer-free'd by skb_attempt_defer_free.  The problem happens when we defer freeing an skb (push it on one CPU's defer_list), and don't flush that list before the netns is deleted. In that case, we still have a reference on the xfrm_state that we don't expect at this point.  We already drop the skb's dst in the TCP receive path when it's no longer needed, so let's also drop the secpath. At this point, tcp_filter has already called into the LSM hooks that may require the secpath, so it should not be needed anymore. However, in some of those places, the MPTCP extension has just been attached to the skb, so we cannot simply drop all extensions.
published:2025-03-12T10:15:19.520


Instruction: Please provide detailed information about CVE-2025-21865

CVE:CVE-2025-21865
Description:In the Linux kernel, the following vulnerability has been resolved:  gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().  Brad Spengler reported the list_del() corruption splat in gtp_net_exit_batch_rtnl(). [0]  Commit eb28fd76c0a0 ("gtp: Destroy device along with udp socket's netns dismantle.") added the for_each_netdev() loop in gtp_net_exit_batch_rtnl() to destroy devices in each netns as done in geneve and ip tunnels.  However, this could trigger ->dellink() twice for the same device during ->exit_batch_rtnl().  Say we have two netns A & B and gtp device B that resides in netns B but whose UDP socket is in netns A.    1. cleanup_net() processes netns A and then B.    2. gtp_net_exit_batch_rtnl() finds the device B while iterating      netns A's gn->gtp_dev_list and calls ->dellink().    [ device B is not yet unlinked from netns B     as unregister_netdevice_many() has not been called. ]    3. gtp_net_exit_batch_rtnl() finds the device B while iterating      netns B's for_each_netdev() and calls ->dellink().  gtp_dellink() cleans up the device's hash table, unlinks the dev from gn->gtp_dev_list, and calls unregister_netdevice_queue().  Basically, calling gtp_dellink() multiple times is fine unless CONFIG_DEBUG_LIST is enabled.  Let's remove for_each_netdev() in gtp_net_exit_batch_rtnl() and delegate the destruction to default_device_exit_batch() as done in bareudp.  [0]: list_del corruption, ffff8880aaa62c00->next (autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]) is LIST_POISON1 (ffffffffffffff02) (prev is 0xffffffffffffff04) kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 UID: 0 PID: 1804 Comm: kworker/u8:7 Tainted: G                T   6.12.13-grsec-full-20250211091339 #1 Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:[<ffffffff84947381>] __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58 Code: c2 76 91 31 c0 e8 9f b1 f7 fc 0f 0b 4d 89 f0 48 c7 c1 02 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 e0 c2 76 91 31 c0 e8 7f b1 f7 fc <0f> 0b 4d 89 e8 48 c7 c1 04 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 60 RSP: 0018:fffffe8040b4fbd0 EFLAGS: 00010283 RAX: 00000000000000cc RBX: dffffc0000000000 RCX: ffffffff818c4054 RDX: ffffffff84947381 RSI: ffffffff818d1512 RDI: 0000000000000000 RBP: ffff8880aaa62c00 R08: 0000000000000001 R09: fffffbd008169f32 R10: fffffe8040b4f997 R11: 0000000000000001 R12: a1988d84f24943e4 R13: ffffffffffffff02 R14: ffffffffffffff04 R15: ffff8880aaa62c08 RBX: kasan shadow of 0x0 RCX: __wake_up_klogd.part.0+0x74/0xe0 kernel/printk/printk.c:4554 RDX: __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58 RSI: vprintk+0x72/0x100 kernel/printk/printk_safe.c:71 RBP: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object] RSP: process kstack fffffe8040b4fbd0+0x7bd0/0x8000 [kworker/u8:7+netns 1804 ] R09: kasan shadow of process kstack fffffe8040b4f990+0x7990/0x8000 [kworker/u8:7+netns 1804 ] R10: process kstack fffffe8040b4f997+0x7997/0x8000 [kworker/u8:7+netns 1804 ] R15: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc08/0x1000 [slab object] FS:  0000000000000000(0000) GS:ffff888116000000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000748f5372c000 CR3: 0000000015408000 CR4: 00000000003406f0 shadow CR4: 00000000003406f0 Stack:  0000000000000000 ffffffff8a0c35e7 ffffffff8a0c3603 ffff8880aaa62c00  ffff8880aaa62c00 0000000000000004 ffff88811145311c 0000000000000005  0000000000000001 ffff8880aaa62000 fffffe8040b4fd40 ffffffff8a0c360d Call Trace:  <TASK>  [<ffffffff8a0c360d>] __list_del_entry_valid include/linux/list.h:131 [inline] fffffe8040b4fc28  [<ffffffff8a0c360d>] __list_del_entry include/linux/list.h:248 [inline] fffffe8040b4fc28  [<ffffffff8a0c360d>] list_del include/linux/list.h:262 [inl ---truncated---
published:2025-03-12T10:15:19.650