Instruction: Please provide detailed information about CVE-2025-21877

CVE:CVE-2025-21877
Description:In the Linux kernel, the following vulnerability has been resolved:  usbnet: gl620a: fix endpoint checking in genelink_bind()  Syzbot reports [1] a warning in usb_submit_urb() triggered by inconsistencies between expected and actually present endpoints in gl620a driver. Since genelink_bind() does not properly verify whether specified eps are in fact provided by the device, in this case, an artificially manufactured one, one may get a mismatch.  Fix the issue by resorting to a usbnet utility function usbnet_get_endpoints(), usually reserved for this very problem. Check for endpoints and return early before proceeding further if any are missing.  [1] Syzbot report: usb 5-1: Manufacturer: syz usb 5-1: SerialNumber: syz usb 5-1: config 0 descriptor?? gl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummy_hcd.0-1, ... ------------[ cut here ]------------ usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Modules linked in: CPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: mld mld_ifc_work RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 ... Call Trace:  <TASK>  usbnet_start_xmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]  netdev_start_xmit include/linux/netdevice.h:5011 [inline]  xmit_one net/core/dev.c:3590 [inline]  dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606  sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343  __dev_xmit_skb net/core/dev.c:3827 [inline]  __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4400  dev_queue_xmit include/linux/netdevice.h:3168 [inline]  neigh_resolve_output net/core/neighbour.c:1514 [inline]  neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494  neigh_output include/net/neighbour.h:539 [inline]  ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141  __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]  ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226  NF_HOOK_COND include/linux/netfilter.h:303 [inline]  ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247  dst_output include/net/dst.h:450 [inline]  NF_HOOK include/linux/netfilter.h:314 [inline]  NF_HOOK include/linux/netfilter.h:308 [inline]  mld_sendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819  mld_send_cr net/ipv6/mcast.c:2120 [inline]  mld_ifc_work+0x740/0xca0 net/ipv6/mcast.c:2651  process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229  process_scheduled_works kernel/workqueue.c:3310 [inline]  worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391  kthread+0x2c1/0x3a0 kernel/kthread.c:389  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244  </TASK>
published:2025-03-27T15:15:55.540


Instruction: Please provide detailed information about CVE-2025-21878

CVE:CVE-2025-21878
Description:In the Linux kernel, the following vulnerability has been resolved:  i2c: npcm: disable interrupt enable bit before devm_request_irq  The customer reports that there is a soft lockup issue related to the i2c driver. After checking, the i2c module was doing a tx transfer and the bmc machine reboots in the middle of the i2c transaction, the i2c module keeps the status without being reset.  Due to such an i2c module status, the i2c irq handler keeps getting triggered since the i2c irq handler is registered in the kernel booting process after the bmc machine is doing a warm rebooting. The continuous triggering is stopped by the soft lockup watchdog timer.  Disable the interrupt enable bit in the i2c module before calling devm_request_irq to fix this issue since the i2c relative status bit is read-only.  Here is the soft lockup log. [   28.176395] watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [swapper/0:1] [   28.183351] Modules linked in: [   28.186407] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.120-yocto-s-dirty-bbebc78 #1 [   28.201174] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [   28.208128] pc : __do_softirq+0xb0/0x368 [   28.212055] lr : __do_softirq+0x70/0x368 [   28.215972] sp : ffffff8035ebca00 [   28.219278] x29: ffffff8035ebca00 x28: 0000000000000002 x27: ffffff80071a3780 [   28.226412] x26: ffffffc008bdc000 x25: ffffffc008bcc640 x24: ffffffc008be50c0 [   28.233546] x23: ffffffc00800200c x22: 0000000000000000 x21: 000000000000001b [   28.240679] x20: 0000000000000000 x19: ffffff80001c3200 x18: ffffffffffffffff [   28.247812] x17: ffffffc02d2e0000 x16: ffffff8035eb8b40 x15: 00001e8480000000 [   28.254945] x14: 02c3647e37dbfcb6 x13: 02c364f2ab14200c x12: 0000000002c364f2 [   28.262078] x11: 00000000fa83b2da x10: 000000000000b67e x9 : ffffffc008010250 [   28.269211] x8 : 000000009d983d00 x7 : 7fffffffffffffff x6 : 0000036d74732434 [   28.276344] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : 0000000000000198 [   28.283476] x2 : ffffffc02d2e0000 x1 : 00000000000000e0 x0 : ffffffc008bdcb40 [   28.290611] Call trace: [   28.293052]  __do_softirq+0xb0/0x368 [   28.296625]  __irq_exit_rcu+0xe0/0x100 [   28.300374]  irq_exit+0x14/0x20 [   28.303513]  handle_domain_irq+0x68/0x90 [   28.307440]  gic_handle_irq+0x78/0xb0 [   28.311098]  call_on_irq_stack+0x20/0x38 [   28.315019]  do_interrupt_handler+0x54/0x5c [   28.319199]  el1_interrupt+0x2c/0x4c [   28.322777]  el1h_64_irq_handler+0x14/0x20 [   28.326872]  el1h_64_irq+0x74/0x78 [   28.330269]  __setup_irq+0x454/0x780 [   28.333841]  request_threaded_irq+0xd0/0x1b4 [   28.338107]  devm_request_threaded_irq+0x84/0x100 [   28.342809]  npcm_i2c_probe_bus+0x188/0x3d0 [   28.346990]  platform_probe+0x6c/0xc4 [   28.350653]  really_probe+0xcc/0x45c [   28.354227]  __driver_probe_device+0x8c/0x160 [   28.358578]  driver_probe_device+0x44/0xe0 [   28.362670]  __driver_attach+0x124/0x1d0 [   28.366589]  bus_for_each_dev+0x7c/0xe0 [   28.370426]  driver_attach+0x28/0x30 [   28.373997]  bus_add_driver+0x124/0x240 [   28.377830]  driver_register+0x7c/0x124 [   28.381662]  __platform_driver_register+0x2c/0x34 [   28.386362]  npcm_i2c_init+0x3c/0x5c [   28.389937]  do_one_initcall+0x74/0x230 [   28.393768]  kernel_init_freeable+0x24c/0x2b4 [   28.398126]  kernel_init+0x28/0x130 [   28.401614]  ret_from_fork+0x10/0x20 [   28.405189] Kernel panic - not syncing: softlockup: hung tasks [   28.411011] SMP: stopping secondary CPUs [   28.414933] Kernel Offset: disabled [   28.418412] CPU features: 0x00000000,00000802 [   28.427644] Rebooting in 20 seconds..
published:2025-03-27T15:15:55.657


Instruction: Please provide detailed information about CVE-2025-21879

CVE:CVE-2025-21879
Description:In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix use-after-free on inode when scanning root during em shrinking  At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled the inode for a delayed iput, and that can result in a use-after-free on the inode in case the cleaner kthread does the iput before we dereference the inode in the call to btrfs_fs_closing().  Fix this by using the fs_info stored already in a local variable instead of doing inode->root->fs_info.
published:2025-03-27T15:15:55.790


Instruction: Please provide detailed information about CVE-2025-21880

CVE:CVE-2025-21880
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/xe/userptr: fix EFAULT handling  Currently we treat EFAULT from hmm_range_fault() as a non-fatal error when called from xe_vm_userptr_pin() with the idea that we want to avoid killing the entire vm and chucking an error, under the assumption that the user just did an unmap or something, and has no intention of actually touching that memory from the GPU.  At this point we have already zapped the PTEs so any access should generate a page fault, and if the pin fails there also it will then become fatal.  However it looks like it's possible for the userptr vma to still be on the rebind list in preempt_rebind_work_func(), if we had to retry the pin again due to something happening in the caller before we did the rebind step, but in the meantime needing to re-validate the userptr and this time hitting the EFAULT.  This explains an internal user report of hitting:  [  191.738349] WARNING: CPU: 1 PID: 157 at drivers/gpu/drm/xe/xe_res_cursor.h:158 xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [  191.738551] Workqueue: xe-ordered-wq preempt_rebind_work_func [xe] [  191.738616] RIP: 0010:xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [  191.738690] Call Trace: [  191.738692]  <TASK> [  191.738694]  ? show_regs+0x69/0x80 [  191.738698]  ? __warn+0x93/0x1a0 [  191.738703]  ? xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [  191.738759]  ? report_bug+0x18f/0x1a0 [  191.738764]  ? handle_bug+0x63/0xa0 [  191.738767]  ? exc_invalid_op+0x19/0x70 [  191.738770]  ? asm_exc_invalid_op+0x1b/0x20 [  191.738777]  ? xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [  191.738834]  ? ret_from_fork_asm+0x1a/0x30 [  191.738849]  bind_op_prepare+0x105/0x7b0 [xe] [  191.738906]  ? dma_resv_reserve_fences+0x301/0x380 [  191.738912]  xe_pt_update_ops_prepare+0x28c/0x4b0 [xe] [  191.738966]  ? kmemleak_alloc+0x4b/0x80 [  191.738973]  ops_execute+0x188/0x9d0 [xe] [  191.739036]  xe_vm_rebind+0x4ce/0x5a0 [xe] [  191.739098]  ? trace_hardirqs_on+0x4d/0x60 [  191.739112]  preempt_rebind_work_func+0x76f/0xd00 [xe]  Followed by NPD, when running some workload, since the sg was never actually populated but the vma is still marked for rebind when it should be skipped for this special EFAULT case. This is confirmed to fix the user report.  v2 (MattB):  - Move earlier. v3 (MattB):  - Update the commit message to make it clear that this indeed fixes the    issue.  (cherry picked from commit 6b93cb98910c826c2e2004942f8b060311e43618)
published:2025-03-27T15:15:55.890


Instruction: Please provide detailed information about CVE-2025-21881

CVE:CVE-2025-21881
Description:In the Linux kernel, the following vulnerability has been resolved:  uprobes: Reject the shared zeropage in uprobe_write_opcode()  We triggered the following crash in syzkaller tests:    BUG: Bad page state in process syz.7.38  pfn:1eff3   page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3   flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff)   raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000   raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000   page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014   Call Trace:    <TASK>    dump_stack_lvl+0x32/0x50    bad_page+0x69/0xf0    free_unref_page_prepare+0x401/0x500    free_unref_page+0x6d/0x1b0    uprobe_write_opcode+0x460/0x8e0    install_breakpoint.part.0+0x51/0x80    register_for_each_vma+0x1d9/0x2b0    __uprobe_register+0x245/0x300    bpf_uprobe_multi_link_attach+0x29b/0x4f0    link_create+0x1e2/0x280    __sys_bpf+0x75f/0xac0    __x64_sys_bpf+0x1a/0x30    do_syscall_64+0x56/0x100    entry_SYSCALL_64_after_hwframe+0x78/0xe2     BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1  The following syzkaller test case can be used to reproduce:    r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8)   write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10)   r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0)   mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0)   r5 = userfaultfd(0x80801)   ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20})   r6 = userfaultfd(0x80801)   ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140))   ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})   ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}})   r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)   bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40)  The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount.  Therefore, two bugs are introduced:   1. The RSS count is incorrect, when process exit, the check_mm() report     error "Bad rss-count".   2. The reserved folio (zero folio) is freed when folio->refcount is zero,     then free_pages_prepare->free_page_is_bad() report error     "Bad page state".  There is more, the following warning could also theoretically be triggered:    __replace_page()     -> ...       -> folio_remove_rmap_pte()         -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio)  Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote().  [ mingo: Cleaned up the changelog ]
published:2025-03-27T15:15:56.000


Instruction: Please provide detailed information about CVE-2025-21882

CVE:CVE-2025-21882
Description:In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix vport QoS cleanup on error  When enabling vport QoS fails, the scheduling node was never freed, causing a leak.  Add the missing free and reset the vport scheduling node pointer to NULL.
published:2025-03-27T15:15:56.117


Instruction: Please provide detailed information about CVE-2025-21883

CVE:CVE-2025-21883
Description:In the Linux kernel, the following vulnerability has been resolved:  ice: Fix deinitializing VF in error path  If ice_ena_vfs() fails after calling ice_create_vf_entries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption.  Reproducer:   devlink dev eswitch set $PF1_PCI mode switchdev   ip l s $PF1 up   ip l s $PF1 promisc on   sleep 1   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs   sleep 1   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs  Trace (minimized):   list_add corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330).   kernel BUG at lib/list_debug.c:29!   RIP: 0010:__list_add_valid_or_report+0xa6/0x100    ice_mbx_init_vf_info+0xa7/0x180 [ice]    ice_initialize_vf_entry+0x1fa/0x250 [ice]    ice_sriov_configure+0x8d7/0x1520 [ice]    ? __percpu_ref_switch_mode+0x1b1/0x5d0    ? __pfx_ice_sriov_configure+0x10/0x10 [ice]  Sometimes a KASAN report can be seen instead with a similar stack trace:   BUG: KASAN: use-after-free in __list_add_valid_or_report+0xf1/0x100  VFs are added to this list in ice_mbx_init_vf_info(), but only removed in ice_free_vfs(). Move the removing to ice_free_vf_entries(), which is also being called in other places where VFs are being removed (including ice_free_vfs() itself).
published:2025-03-27T15:15:56.210


Instruction: Please provide detailed information about CVE-2025-21884

CVE:CVE-2025-21884
Description:In the Linux kernel, the following vulnerability has been resolved:  net: better track kernel sockets lifetime  While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls.  This then trigger the following warning from ref_tracker_dir_exit() [1]  To fix this, make sure that kernel sockets own a reference on net->passive.  Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one.  [1]  [  136.263918][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [  136.263918][   T35]      sk_alloc+0x2b3/0x370 [  136.263918][   T35]      inet6_create+0x6ce/0x10f0 [  136.263918][   T35]      __sock_create+0x4c0/0xa30 [  136.263918][   T35]      inet_ctl_sock_create+0xc2/0x250 [  136.263918][   T35]      igmp6_net_init+0x39/0x390 [  136.263918][   T35]      ops_init+0x31e/0x590 [  136.263918][   T35]      setup_net+0x287/0x9e0 [  136.263918][   T35]      copy_net_ns+0x33f/0x570 [  136.263918][   T35]      create_new_namespaces+0x425/0x7b0 [  136.263918][   T35]      unshare_nsproxy_namespaces+0x124/0x180 [  136.263918][   T35]      ksys_unshare+0x57d/0xa70 [  136.263918][   T35]      __x64_sys_unshare+0x38/0x40 [  136.263918][   T35]      do_syscall_64+0xf3/0x230 [  136.263918][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f [  136.263918][   T35] [  136.343488][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [  136.343488][   T35]      sk_alloc+0x2b3/0x370 [  136.343488][   T35]      inet6_create+0x6ce/0x10f0 [  136.343488][   T35]      __sock_create+0x4c0/0xa30 [  136.343488][   T35]      inet_ctl_sock_create+0xc2/0x250 [  136.343488][   T35]      ndisc_net_init+0xa7/0x2b0 [  136.343488][   T35]      ops_init+0x31e/0x590 [  136.343488][   T35]      setup_net+0x287/0x9e0 [  136.343488][   T35]      copy_net_ns+0x33f/0x570 [  136.343488][   T35]      create_new_namespaces+0x425/0x7b0 [  136.343488][   T35]      unshare_nsproxy_namespaces+0x124/0x180 [  136.343488][   T35]      ksys_unshare+0x57d/0xa70 [  136.343488][   T35]      __x64_sys_unshare+0x38/0x40 [  136.343488][   T35]      do_syscall_64+0xf3/0x230 [  136.343488][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f
published:2025-03-27T15:15:56.313


Instruction: Please provide detailed information about CVE-2025-21885

CVE:CVE-2025-21885
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers  While using nvme target with use_srq on, below kernel panic is noticed.  [  549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514) [  566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI .. [  566.393799]  <TASK> [  566.393807]  ? __die_body+0x1a/0x60 [  566.393823]  ? die+0x38/0x60 [  566.393835]  ? do_trap+0xe4/0x110 [  566.393847]  ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [  566.393867]  ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [  566.393881]  ? do_error_trap+0x7c/0x120 [  566.393890]  ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [  566.393911]  ? exc_divide_error+0x34/0x50 [  566.393923]  ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [  566.393939]  ? asm_exc_divide_error+0x16/0x20 [  566.393966]  ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [  566.393997]  bnxt_qplib_create_srq+0xc9/0x340 [bnxt_re] [  566.394040]  bnxt_re_create_srq+0x335/0x3b0 [bnxt_re] [  566.394057]  ? srso_return_thunk+0x5/0x5f [  566.394068]  ? __init_swait_queue_head+0x4a/0x60 [  566.394090]  ib_create_srq_user+0xa7/0x150 [ib_core] [  566.394147]  nvmet_rdma_queue_connect+0x7d0/0xbe0 [nvmet_rdma] [  566.394174]  ? lock_release+0x22c/0x3f0 [  566.394187]  ? srso_return_thunk+0x5/0x5f  Page size and shift info is set only for the user space SRQs. Set page size and page shift for kernel space SRQs also.
published:2025-03-27T15:15:56.410


Instruction: Please provide detailed information about CVE-2025-21886

CVE:CVE-2025-21886
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix implicit ODP hang on parent deregistration  Fix the destroy_unused_implicit_child_mr() to prevent hanging during parent deregistration as of below [1].  Upon entering destroy_unused_implicit_child_mr(), the reference count for the implicit MR parent is incremented using: refcount_inc_not_zero().  A corresponding decrement must be performed if free_implicit_child_mr_work() is not called.  The code has been updated to properly manage the reference count that was incremented.  [1] INFO: task python3:2157 blocked for more than 120 seconds. Not tainted 6.12.0-rc7+ #1633 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:python3         state:D stack:0     pid:2157 tgid:2157  ppid:1685   flags:0x00000000 Call Trace: <TASK> __schedule+0x420/0xd30 schedule+0x47/0x130 __mlx5_ib_dereg_mr+0x379/0x5d0 [mlx5_ib] ? __pfx_autoremove_wake_function+0x10/0x10 ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]  __x64_sys_ioctl+0x1b0/0xa70 ? kmem_cache_free+0x221/0x400 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f20f21f017b RSP: 002b:00007ffcfc4a77c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b RDX: 00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890 R13: 000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0 </TASK>
published:2025-03-27T15:15:56.510


Instruction: Please provide detailed information about CVE-2025-21887

CVE:CVE-2025-21887
Description:In the Linux kernel, the following vulnerability has been resolved:  ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up  The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote().  Move dput(upper) after its last use to prevent use-after-free.  BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167  Call Trace:  <TASK>  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114  print_address_description mm/kasan/report.c:377 [inline]  print_report+0xc3/0x620 mm/kasan/report.c:488  kasan_report+0xd9/0x110 mm/kasan/report.c:601  ovl_dentry_remote fs/overlayfs/util.c:162 [inline]  ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167  ovl_link_up fs/overlayfs/copy_up.c:610 [inline]  ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170  ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223  ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136  vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ...  </TASK>
published:2025-03-27T15:15:56.603


Instruction: Please provide detailed information about CVE-2025-21888

CVE:CVE-2025-21888
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix a WARN during dereg_mr for DM type  Memory regions (MR) of type DM (device memory) do not have an associated umem.  In the __mlx5_ib_dereg_mr() -> mlx5_free_priv_descs() flow, the code incorrectly takes the wrong branch, attempting to call dma_unmap_single() on a DMA address that is not mapped.  This results in a WARN [1], as shown below.  The issue is resolved by properly accounting for the DM type and ensuring the correct branch is selected in mlx5_free_priv_descs().  [1] WARNING: CPU: 12 PID: 1346 at drivers/iommu/dma-iommu.c:1230 iommu_dma_unmap_page+0x79/0x90 Modules linked in: ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry ovelay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core CPU: 12 UID: 0 PID: 1346 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1631 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 49 3b 29 72 26 49 3b 69 08 73 20 4d 89 f0 44 89 e9 4c 89 e2 48 89 ee 48 89 df 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 b8 88 ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 66 0f 1f 44 00 RSP: 0018:ffffc90001913a10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810194b0a8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffff88810194b0a8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS:  00007f537abdd740(0000) GS:ffff88885fb00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f537aeb8000 CR3: 000000010c248001 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x84/0x190 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0xf8/0x1c0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 dma_unmap_page_attrs+0xe6/0x290 mlx5_free_priv_descs+0xb0/0xe0 [mlx5_ib] __mlx5_ib_dereg_mr+0x37e/0x520 [mlx5_ib] ? _raw_spin_unlock_irq+0x24/0x40 ? wait_for_completion+0xfe/0x130 ? rdma_restrack_put+0x63/0xe0 [ib_core] ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] __x64_sys_ioctl+0x1b0/0xa70 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f537adaf17b Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffff218f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff218f1d8 RCX: 00007f537adaf17b RDX: 00007ffff218f1c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffff218f1a0 R08: 00007f537aa8d010 R09: 0000561ee2e4f270 R10: 00007f537aace3a8 R11: 0000000000000246 R12: 00007ffff218f190 R13: 000000000000001c R14: 0000561ee2e4d7c0 R15: 00007ffff218f450 </TASK>
published:2025-03-27T15:15:56.710


Instruction: Please provide detailed information about CVE-2025-21889

CVE:CVE-2025-21889
Description:In the Linux kernel, the following vulnerability has been resolved:  perf/core: Add RCU read lock protection to perf_iterate_ctx()  The perf_iterate_ctx() function performs RCU list traversal but currently lacks RCU read lock protection. This causes lockdep warnings when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:  	WARNING: suspicious RCU usage 	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!  	 Call Trace: 	  lockdep_rcu_suspicious 	  ? perf_event_addr_filters_apply 	  perf_iterate_ctx 	  perf_event_exec 	  begin_new_exec 	  ? load_elf_phdrs 	  load_elf_binary 	  ? lock_acquire 	  ? find_held_lock 	  ? bprm_execve 	  bprm_execve 	  do_execveat_common.isra.0 	  __x64_sys_execve 	  do_syscall_64 	  entry_SYSCALL_64_after_hwframe  This protection was previously present but was removed in commit bd2756811766 ("perf: Rewrite core context handling"). Add back the necessary rcu_read_lock()/rcu_read_unlock() pair around perf_iterate_ctx() call in perf_event_exec().  [ mingo: Use scoped_guard() as suggested by Peter ]
published:2025-03-27T15:15:56.820


Instruction: Please provide detailed information about CVE-2025-21890

CVE:CVE-2025-21890
Description:In the Linux kernel, the following vulnerability has been resolved:  idpf: fix checksums set in idpf_rx_rsc()  idpf_rx_rsc() uses skb_transport_offset(skb) while the transport header is not set yet.  This triggers the following warning for CONFIG_DEBUG_NET=y builds.  DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb))  [   69.261620] WARNING: CPU: 7 PID: 0 at ./include/linux/skbuff.h:3020 idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [   69.261629] Modules linked in: vfat fat dummy bridge intel_uncore_frequency_tpmi intel_uncore_frequency_common intel_vsec_tpmi idpf intel_vsec cdc_ncm cdc_eem cdc_ether usbnet mii xhci_pci xhci_hcd ehci_pci ehci_hcd libeth [   69.261644] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G S      W          6.14.0-smp-DEV #1697 [   69.261648] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [   69.261650] RIP: 0010:idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [   69.261677] ? __warn (kernel/panic.c:242 kernel/panic.c:748) [   69.261682] ? idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [   69.261687] ? report_bug (lib/bug.c:?) [   69.261690] ? handle_bug (arch/x86/kernel/traps.c:285) [   69.261694] ? exc_invalid_op (arch/x86/kernel/traps.c:309) [   69.261697] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [   69.261700] ? __pfx_idpf_vport_splitq_napi_poll (drivers/net/ethernet/intel/idpf/idpf_txrx.c:4011) idpf [   69.261704] ? idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [   69.261708] ? idpf_vport_splitq_napi_poll (drivers/net/ethernet/intel/idpf/idpf_txrx.c:3072) idpf [   69.261712] __napi_poll (net/core/dev.c:7194) [   69.261716] net_rx_action (net/core/dev.c:7265) [   69.261718] ? __qdisc_run (net/sched/sch_generic.c:293) [   69.261721] ? sched_clock (arch/x86/include/asm/preempt.h:84 arch/x86/kernel/tsc.c:288) [   69.261726] handle_softirqs (kernel/softirq.c:561)
published:2025-03-27T15:15:56.923


Instruction: Please provide detailed information about CVE-2025-21891

CVE:CVE-2025-21891
Description:In the Linux kernel, the following vulnerability has been resolved:  ipvlan: ensure network headers are in skb linear part  syzbot found that ipvlan_process_v6_outbound() was assuming the IPv6 network header isis present in skb->head [1]  Add the needed pskb_network_may_pull() calls for both IPv4 and IPv6 handlers.  [1] BUG: KMSAN: uninit-value in __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47   __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47   ipv6_addr_type include/net/ipv6.h:555 [inline]   ip6_route_output_flags_noref net/ipv6/route.c:2616 [inline]   ip6_route_output_flags+0x51/0x720 net/ipv6/route.c:2651   ip6_route_output include/net/ip6_route.h:93 [inline]   ipvlan_route_v6_outbound+0x24e/0x520 drivers/net/ipvlan/ipvlan_core.c:476   ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:491 [inline]   ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:541 [inline]   ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:605 [inline]   ipvlan_queue_xmit+0xd72/0x1780 drivers/net/ipvlan/ipvlan_core.c:671   ipvlan_start_xmit+0x5b/0x210 drivers/net/ipvlan/ipvlan_main.c:223   __netdev_start_xmit include/linux/netdevice.h:5150 [inline]   netdev_start_xmit include/linux/netdevice.h:5159 [inline]   xmit_one net/core/dev.c:3735 [inline]   dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3751   sch_direct_xmit+0x399/0xd40 net/sched/sch_generic.c:343   qdisc_restart net/sched/sch_generic.c:408 [inline]   __qdisc_run+0x14da/0x35d0 net/sched/sch_generic.c:416   qdisc_run+0x141/0x4d0 include/net/pkt_sched.h:127   net_tx_action+0x78b/0x940 net/core/dev.c:5484   handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561   __do_softirq+0x14/0x1a kernel/softirq.c:595   do_softirq+0x9a/0x100 kernel/softirq.c:462   __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389   local_bh_enable include/linux/bottom_half.h:33 [inline]   rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]   __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4611   dev_queue_xmit include/linux/netdevice.h:3311 [inline]   packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276   packet_snd net/packet/af_packet.c:3132 [inline]   packet_sendmsg+0x93e0/0xa7e0 net/packet/af_packet.c:3164   sock_sendmsg_nosec net/socket.c:718 [inline]
published:2025-03-27T15:15:57.027


Instruction: Please provide detailed information about CVE-2025-21892

CVE:CVE-2025-21892
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix the recovery flow of the UMR QP  This patch addresses an issue in the recovery flow of the UMR QP, ensuring tasks do not get stuck, as highlighted by the call trace [1].  During recovery, before transitioning the QP to the RESET state, the software must wait for all outstanding WRs to complete.  Failing to do so can cause the firmware to skip sending some flushed CQEs with errors and simply discard them upon the RESET, as per the IB specification.  This race condition can result in lost CQEs and tasks becoming stuck.  To resolve this, the patch sends a final WR which serves only as a barrier before moving the QP state to RESET.  Once a CQE is received for that final WR, it guarantees that no outstanding WRs remain, making it safe to transition the QP to RESET and subsequently back to RTS, restoring proper functionality.  Note: For the barrier WR, we simply reuse the failed and ready WR. Since the QP is in an error state, it will only receive IB_WC_WR_FLUSH_ERR. However, as it serves only as a barrier we don't care about its status.  [1] INFO: task rdma_resource_l:1922 blocked for more than 120 seconds. Tainted: G        W          6.12.0-rc7+ #1626 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:rdma_resource_l state:D stack:0  pid:1922 tgid:1922  ppid:1369      flags:0x00004004 Call Trace: <TASK> __schedule+0x420/0xd30 schedule+0x47/0x130 schedule_timeout+0x280/0x300 ? mark_held_locks+0x48/0x80 ? lockdep_hardirqs_on_prepare+0xe5/0x1a0 wait_for_completion+0x75/0x130 mlx5r_umr_post_send_wait+0x3c2/0x5b0 [mlx5_ib] ? __pfx_mlx5r_umr_done+0x10/0x10 [mlx5_ib] mlx5r_umr_revoke_mr+0x93/0xc0 [mlx5_ib] __mlx5_ib_dereg_mr+0x299/0x520 [mlx5_ib] ? _raw_spin_unlock_irq+0x24/0x40 ? wait_for_completion+0xfe/0x130 ? rdma_restrack_put+0x63/0xe0 [ib_core] ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? __lock_acquire+0x64e/0x2080 ? mark_held_locks+0x48/0x80 ? find_held_lock+0x2d/0xa0 ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? __fget_files+0xc3/0x1b0 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] __x64_sys_ioctl+0x1b0/0xa70 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f99c918b17b RSP: 002b:00007ffc766d0468 EFLAGS: 00000246 ORIG_RAX:      0000000000000010 RAX: ffffffffffffffda RBX: 00007ffc766d0578 RCX:      00007f99c918b17b RDX: 00007ffc766d0560 RSI: 00000000c0181b01 RDI:      0000000000000003 RBP: 00007ffc766d0540 R08: 00007f99c8f99010 R09:      000000000000bd7e R10: 00007f99c94c1c70 R11: 0000000000000246 R12:      00007ffc766d0530 R13: 000000000000001c R14: 0000000040246a80 R15:      0000000000000000 </TASK>
published:2025-03-27T15:15:57.143


Instruction: Please provide detailed information about CVE-2025-22644

CVE:CVE-2025-22644
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through 1.2.1.
published:2025-03-27T15:15:57.247


Instruction: Please provide detailed information about CVE-2025-22646

CVE:CVE-2025-22646
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemes aThemes Addons for Elementor allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through 1.0.8.
published:2025-03-27T15:15:57.397


Instruction: Please provide detailed information about CVE-2025-22647

CVE:CVE-2025-22647
Description:Missing Authorization vulnerability in smackcoders AIO Performance Profiler, Monitor, Optimize, Compress & Debug allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through 1.2.
published:2025-03-27T15:15:57.543


Instruction: Please provide detailed information about CVE-2025-22648

CVE:CVE-2025-22648
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor: from n/a through 2.0.1.
published:2025-03-27T15:15:57.683


Instruction: Please provide detailed information about CVE-2025-22649

CVE:CVE-2025-22649
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through 2.6.22.
published:2025-03-27T15:15:57.830


Instruction: Please provide detailed information about CVE-2025-22652

CVE:CVE-2025-22652
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kendysond Payment Forms for Paystack allows SQL Injection.This issue affects Payment Forms for Paystack: from n/a through 4.0.1.
published:2025-03-27T15:15:57.980


Instruction: Please provide detailed information about CVE-2025-22658

CVE:CVE-2025-22658
Description:Cross-Site Request Forgery (CSRF) vulnerability in Deepak Khokhar Listings for Appfolio allows Stored XSS.This issue affects Listings for Appfolio: from n/a through 1.2.0.
published:2025-03-27T15:15:58.123


Instruction: Please provide detailed information about CVE-2025-22659

CVE:CVE-2025-22659
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through 2.10.44.
published:2025-03-27T15:15:58.283


Instruction: Please provide detailed information about CVE-2025-22660

CVE:CVE-2025-22660
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wolfgang Include Mastodon Feed allows DOM-Based XSS.This issue affects Include Mastodon Feed: from n/a through 1.9.9.
published:2025-03-27T15:15:58.460


Instruction: Please provide detailed information about CVE-2025-22665

CVE:CVE-2025-22665
Description:Missing Authorization vulnerability in Shakeeb Sadikeen RapidLoad allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RapidLoad: from n/a through 2.4.4.
published:2025-03-27T15:15:58.600


Instruction: Please provide detailed information about CVE-2025-22667

CVE:CVE-2025-22667
Description:Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets.This issue affects Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: from n/a through 1.8.2.
published:2025-03-27T15:15:58.750


Instruction: Please provide detailed information about CVE-2025-22668

CVE:CVE-2025-22668
Description:Missing Authorization vulnerability in AwesomeTOGI Awesome Event Booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Event Booking: from n/a through 2.7.2.
published:2025-03-27T15:15:58.903


Instruction: Please provide detailed information about CVE-2025-22669

CVE:CVE-2025-22669
Description:Cross-Site Request Forgery (CSRF) vulnerability in AwesomeTOGI Awesome Event Booking allows Cross Site Request Forgery.This issue affects Awesome Event Booking: from n/a through 2.7.5.
published:2025-03-27T15:15:59.047


Instruction: Please provide detailed information about CVE-2025-22670

CVE:CVE-2025-22670
Description:Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.7.2.
published:2025-03-27T15:15:59.207


Instruction: Please provide detailed information about CVE-2025-22671

CVE:CVE-2025-22671
Description:Missing Authorization vulnerability in Leap13 Disable Elementor Editor Translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Disable Elementor Editor Translation: from n/a through 1.0.2.
published:2025-03-27T15:15:59.360


Instruction: Please provide detailed information about CVE-2025-29483

CVE:CVE-2025-29483
Description:libming v0.4.8 was discovered to contain a memory leak via the parseSWF_ENABLEDEBUGGER2 function.
published:2025-03-27T15:15:59.640


Instruction: Please provide detailed information about CVE-2025-29484

CVE:CVE-2025-29484
Description:An out-of-memory error in the parseABC_NS_SET_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion.
published:2025-03-27T15:15:59.760


Instruction: Please provide detailed information about CVE-2025-29485

CVE:CVE-2025-29485
Description:libming v0.4.8 was discovered to contain a segmentation fault via the decompileRETURN function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
published:2025-03-27T15:15:59.867


Instruction: Please provide detailed information about CVE-2025-29486

CVE:CVE-2025-29486
Description:libming v0.4.8 was discovered to contain a memory leak via the parseSWF_PLACEOBJECT3 function.
published:2025-03-27T15:15:59.983


Instruction: Please provide detailed information about CVE-2025-29487

CVE:CVE-2025-29487
Description:An out-of-memory error in the parseABC_STRING_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion.
published:2025-03-27T15:16:00.093


Instruction: Please provide detailed information about CVE-2025-29488

CVE:CVE-2025-29488
Description:libming v0.4.8 was discovered to contain a memory leak via the parseSWF_INITACTION function.
published:2025-03-27T15:16:00.207


Instruction: Please provide detailed information about CVE-2025-29489

CVE:CVE-2025-29489
Description:libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHLINESTYLES function.
published:2025-03-27T15:16:00.313


Instruction: Please provide detailed information about CVE-2025-29490

CVE:CVE-2025-29490
Description:libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
published:2025-03-27T15:16:00.437


Instruction: Please provide detailed information about CVE-2025-29491

CVE:CVE-2025-29491
Description:An allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DoS) via supplying a crafted SWF file.
published:2025-03-27T15:16:00.547


Instruction: Please provide detailed information about CVE-2025-29492

CVE:CVE-2025-29492
Description:libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function.
published:2025-03-27T15:16:00.653


Instruction: Please provide detailed information about CVE-2025-29493

CVE:CVE-2025-29493
Description:libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
published:2025-03-27T15:16:00.763


Instruction: Please provide detailed information about CVE-2025-29494

CVE:CVE-2025-29494
Description:libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
published:2025-03-27T15:16:00.880


Instruction: Please provide detailed information about CVE-2025-29496

CVE:CVE-2025-29496
Description:libming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
published:2025-03-27T15:16:00.990


Instruction: Please provide detailed information about CVE-2025-29497

CVE:CVE-2025-29497
Description:libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function.
published:2025-03-27T15:16:01.103


Instruction: Please provide detailed information about CVE-2025-2516

CVE:CVE-2025-2516
Description:The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components.  As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.
published:2025-03-27T15:16:01.280


Instruction: Please provide detailed information about CVE-2025-2854

CVE:CVE-2025-2854
Description:A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file update_employee.php. The manipulation of the argument emp_type leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-27T15:16:01.713


Instruction: Please provide detailed information about CVE-2025-30067

CVE:CVE-2025-30067
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.  If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.  This issue affects Apache Kylin: from 4.0.0 through 5.0.1.  Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.
published:2025-03-27T15:16:02.033


Instruction: Please provide detailed information about CVE-2025-30221

CVE:CVE-2025-30221
Description:Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.
published:2025-03-27T15:16:02.150


Instruction: Please provide detailed information about CVE-2025-30358

CVE:CVE-2025-30358
Description:Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service (DoS) attack against the server. Additionally, it could also result in other severe consequences given the application's implementation, such as identity confusion, where an attacker could impersonate an assistant or system role within conversations. This impersonation could potentially enable jailbreak attacks when interacting with large language models (LLMs). Just like the Javascript's prototype pollution, this vulnerability could leave a way for attackers to manipulate the intended data-flow or control-flow of the application at runtime and lead to severe consequences like remote code execution when gadgets are available. Users should upgrade to version 0.14.1 to obtain a fix for the issue.
published:2025-03-27T15:16:02.297


Instruction: Please provide detailed information about CVE-2025-31176

CVE:CVE-2025-31176
Description:A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.
published:2025-03-27T15:16:03.073


Instruction: Please provide detailed information about CVE-2025-31178

CVE:CVE-2025-31178
Description:A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.
published:2025-03-27T15:16:03.230


Instruction: Please provide detailed information about CVE-2025-31179

CVE:CVE-2025-31179
Description:A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.
published:2025-03-27T15:16:03.390


Instruction: Please provide detailed information about CVE-2025-31180

CVE:CVE-2025-31180
Description:A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.
published:2025-03-27T15:16:03.540


Instruction: Please provide detailed information about CVE-2025-31181

CVE:CVE-2025-31181
Description:A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.
published:2025-03-27T15:16:03.697


Instruction: Please provide detailed information about CVE-2025-22278

CVE:CVE-2025-22278
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes Whitish Lite allows Stored XSS.This issue affects Whitish Lite: from n/a through 2.1.13.
published:2025-03-27T16:15:27.640


Instruction: Please provide detailed information about CVE-2025-22496

CVE:CVE-2025-22496
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell allows Stored XSS.This issue affects Notif Bell: from n/a through 0.9.8.
published:2025-03-27T16:15:27.810


Instruction: Please provide detailed information about CVE-2025-22497

CVE:CVE-2025-22497
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A.H.C. Waasdorp Simple Google Calendar Outlook Events Block Widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through 2.5.0.
published:2025-03-27T16:15:27.963


Instruction: Please provide detailed information about CVE-2025-22628

CVE:CVE-2025-22628
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision Filled In allows Stored XSS.This issue affects Filled In: from n/a through 1.9.2.
published:2025-03-27T16:15:28.130


Instruction: Please provide detailed information about CVE-2025-22629

CVE:CVE-2025-22629
Description:Missing Authorization vulnerability in iNET iNET Webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through 1.2.2.
published:2025-03-27T16:15:28.280


Instruction: Please provide detailed information about CVE-2025-22634

CVE:CVE-2025-22634
Description:Cross-Site Request Forgery (CSRF) vulnerability in MD Abu Jubayer Hossain Easy Booked – Appointment Booking and Scheduling Management System for WordPress allows Cross Site Request Forgery.This issue affects Easy Booked – Appointment Booking and Scheduling Management System for WordPress: from n/a through 2.4.5.
published:2025-03-27T16:15:28.433


Instruction: Please provide detailed information about CVE-2025-22637

CVE:CVE-2025-22637
Description:Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher allows Cross Site Request Forgery.This issue affects Print PDF Generator and Publisher: from n/a through 1.2.0.
published:2025-03-27T16:15:28.580


Instruction: Please provide detailed information about CVE-2025-22638

CVE:CVE-2025-22638
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Table For WooCommerce allows Stored XSS.This issue affects Product Table For WooCommerce: from n/a through 1.2.3.
published:2025-03-27T16:15:28.723


Instruction: Please provide detailed information about CVE-2025-22640

CVE:CVE-2025-22640
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paytm Paytm Payment Donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through 2.3.3.
published:2025-03-27T16:15:28.880


Instruction: Please provide detailed information about CVE-2025-22783

CVE:CVE-2025-22783
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO allows SQL Injection.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.4.03.
published:2025-03-27T16:15:29.787


Instruction: Please provide detailed information about CVE-2025-25686

CVE:CVE-2025-25686
Description:semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
published:2025-03-27T16:15:29.987


Instruction: Please provide detailed information about CVE-2025-26265

CVE:CVE-2025-26265
Description:A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response.
published:2025-03-27T16:15:30.117


Instruction: Please provide detailed information about CVE-2025-26762

CVE:CVE-2025-26762
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce allows Stored XSS.This issue affects WooCommerce: from n/a through 9.7.0.
published:2025-03-27T16:15:30.250


Instruction: Please provide detailed information about CVE-2025-26909

CVE:CVE-2025-26909
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through 5.4.01.
published:2025-03-27T16:15:30.400


Instruction: Please provide detailed information about CVE-2025-28135

CVE:CVE-2025-28135
Description:TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
published:2025-03-27T16:15:30.613


Instruction: Please provide detailed information about CVE-2025-28138

CVE:CVE-2025-28138
Description:TOTOLINK A800R V4.1.2cu.5137_B20200730 contains a remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
published:2025-03-27T16:15:30.773


Instruction: Please provide detailed information about CVE-2025-29072

CVE:CVE-2025-29072
Description:An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.
published:2025-03-27T16:15:30.903


Instruction: Please provide detailed information about CVE-2025-2855

CVE:CVE-2025-2855
Description:A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely.
published:2025-03-27T16:15:31.177


Instruction: Please provide detailed information about CVE-2025-30361

CVE:CVE-2025-30361
Description:WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass authentication and authorization mechanisms to reset the password of any user, including admin accounts. Version 3.2.6 fixes the issue.
published:2025-03-27T17:15:57.167


Instruction: Please provide detailed information about CVE-2025-30362

CVE:CVE-2025-30362
Description:WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.8. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.
published:2025-03-27T17:15:57.357


Instruction: Please provide detailed information about CVE-2025-30363

CVE:CVE-2025-30363
Description:WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.6. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.6 fixes the issue.
published:2025-03-27T17:15:57.543


Instruction: Please provide detailed information about CVE-2025-30364

CVE:CVE-2025-30364
Description:WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the id_funcionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.2.8 fixes the issue.
published:2025-03-27T17:15:57.720


Instruction: Please provide detailed information about CVE-2025-30365

CVE:CVE-2025-30365
Description:WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/sistema/controller/query_geracao_auto.php, specifically in the query parameter. This vulnerability allows the execution of arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. Version 3.2.8 fixes the issue.
published:2025-03-27T17:15:57.880


Instruction: Please provide detailed information about CVE-2025-30366

CVE:CVE-2025-30366
Description:WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.
published:2025-03-27T17:15:58.047


Instruction: Please provide detailed information about CVE-2025-30367

CVE:CVE-2025-30367
Description:WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.2.6 contains a fix for the issue.
published:2025-03-27T17:15:58.237


Instruction: Please provide detailed information about CVE-2025-29306

CVE:CVE-2025-29306
Description:An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
published:2025-03-27T19:15:49.290


Instruction: Please provide detailed information about CVE-2025-30093

CVE:CVE-2025-30093
Description:HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions.
published:2025-03-27T19:15:49.677


Instruction: Please provide detailed information about CVE-2025-22739

CVE:CVE-2025-22739
Description:Missing Authorization vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.2.7.5.
published:2025-03-27T22:15:16.590


Instruction: Please provide detailed information about CVE-2025-22740

CVE:CVE-2025-22740
Description:Missing Authorization vulnerability in Automattic Sensei LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through 4.24.4.
published:2025-03-27T22:15:16.747


Instruction: Please provide detailed information about CVE-2025-26733

CVE:CVE-2025-26733
Description:Missing Authorization vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.
published:2025-03-27T22:15:17.003


Instruction: Please provide detailed information about CVE-2025-26873

CVE:CVE-2025-26873
Description:Deserialization of Untrusted Data vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.
published:2025-03-27T22:15:17.150


Instruction: Please provide detailed information about CVE-2025-26874

CVE:CVE-2025-26874
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MemberSpace allows Reflected XSS.This issue affects MemberSpace: from n/a through 2.1.13.
published:2025-03-27T22:15:17.293


Instruction: Please provide detailed information about CVE-2025-26890

CVE:CVE-2025-26890
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginUs.Net HUSKY allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through 1.3.6.4.
published:2025-03-27T22:15:17.440


Instruction: Please provide detailed information about CVE-2025-26898

CVE:CVE-2025-26898
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.
published:2025-03-27T22:15:17.573


Instruction: Please provide detailed information about CVE-2025-26956

CVE:CVE-2025-26956
Description:Missing Authorization vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.
published:2025-03-27T22:15:17.717


Instruction: Please provide detailed information about CVE-2025-28253

CVE:CVE-2025-28253
Description:Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-03-27T23:15:34.867


Instruction: Please provide detailed information about CVE-2025-2878

CVE:CVE-2025-2878
Description:A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-03-27T23:15:35.067


Instruction: Please provide detailed information about CVE-2025-2885

CVE:CVE-2025-2885
Description:Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
published:2025-03-27T23:15:35.240


Instruction: Please provide detailed information about CVE-2025-2886

CVE:CVE-2025-2886
Description:Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
published:2025-03-27T23:15:35.410


Instruction: Please provide detailed information about CVE-2025-2887

CVE:CVE-2025-2887
Description:During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
published:2025-03-27T23:15:35.560


Instruction: Please provide detailed information about CVE-2025-2888

CVE:CVE-2025-2888
Description:During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
published:2025-03-27T23:15:35.717


Instruction: Please provide detailed information about CVE-2025-31031

CVE:CVE-2025-31031
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through 1.0.4.
published:2025-03-27T23:15:35.850


Instruction: Please provide detailed information about CVE-2025-31101

CVE:CVE-2025-31101
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0.
published:2025-03-27T23:15:35.980


Instruction: Please provide detailed information about CVE-2025-30232

CVE:CVE-2025-30232
Description:A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.
published:2025-03-28T00:15:14.130


Instruction: Please provide detailed information about CVE-2025-31092

CVE:CVE-2025-31092
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget allows Stored XSS. This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through 2.3.4.
published:2025-03-28T00:15:14.283


Instruction: Please provide detailed information about CVE-2025-1860

CVE:CVE-2025-1860
Description:Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
published:2025-03-28T01:15:16.063


Instruction: Please provide detailed information about CVE-2025-22398

CVE:CVE-2025-22398
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it can be leveraged to completely compromise the operating system. Dell recommends customers to upgrade at the earliest opportunity.
published:2025-03-28T02:15:14.063


Instruction: Please provide detailed information about CVE-2025-24382

CVE:CVE-2025-24382
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
published:2025-03-28T02:15:14.217


Instruction: Please provide detailed information about CVE-2025-24383

CVE:CVE-2025-24383
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to delete arbitrary files. This vulnerability is considered critical as it can be leveraged to delete critical system files as root. Dell recommends customers to upgrade at the earliest opportunity.
published:2025-03-28T02:15:14.367


Instruction: Please provide detailed information about CVE-2025-23383

CVE:CVE-2025-23383
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
published:2025-03-28T03:15:17.297


Instruction: Please provide detailed information about CVE-2025-24377

CVE:CVE-2025-24377
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges.
published:2025-03-28T03:15:17.460


Instruction: Please provide detailed information about CVE-2025-24378

CVE:CVE-2025-24378
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
published:2025-03-28T03:15:17.617


Instruction: Please provide detailed information about CVE-2025-24379

CVE:CVE-2025-24379
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
published:2025-03-28T03:15:17.783


Instruction: Please provide detailed information about CVE-2025-24380

CVE:CVE-2025-24380
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
published:2025-03-28T03:15:17.953


Instruction: Please provide detailed information about CVE-2025-24381

CVE:CVE-2025-24381
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information. Exploitation may allow for session theft.
published:2025-03-28T03:15:18.120


Instruction: Please provide detailed information about CVE-2025-24385

CVE:CVE-2025-24385
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges.
published:2025-03-28T03:15:18.453


Instruction: Please provide detailed information about CVE-2025-24386

CVE:CVE-2025-24386
Description:Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
published:2025-03-28T03:15:18.620


Instruction: Please provide detailed information about CVE-2025-2894

CVE:CVE-2025-2894
Description:The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.
published:2025-03-28T03:15:18.780


Instruction: Please provide detailed information about CVE-2025-2294

CVE:CVE-2025-2294
Description:The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
published:2025-03-28T05:15:41.507


Instruction: Please provide detailed information about CVE-2025-1762

CVE:CVE-2025-1762
Description:The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
published:2025-03-28T06:15:32.770


Instruction: Please provide detailed information about CVE-2025-2027

CVE:CVE-2025-2027
Description:A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances. Refer to the 'Security Update for MyASUS' section on the ASUS Security Advisory for more information.
published:2025-03-28T06:15:33.403


Instruction: Please provide detailed information about CVE-2025-2804

CVE:CVE-2025-2804
Description:The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-28T06:15:34.157


Instruction: Please provide detailed information about CVE-2025-31335

CVE:CVE-2025-31335
Description:The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).
published:2025-03-28T06:15:34.723


Instruction: Please provide detailed information about CVE-2025-2328

CVE:CVE-2025-2328
Description:The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dnd_remove_uploaded_files' function in all versions up to, and including, 1.3.8.7. This makes it possible for unauthenticated attackers to add arbitrary file paths (such as ../../../../wp-config.php) to uploaded files on the server, which can easily lead to remote code execution when an Administrator deletes the message. Exploiting this vulnerability requires the Flamingo plugin to be installed and activated.
published:2025-03-28T07:15:39.243


Instruction: Please provide detailed information about CVE-2025-2485

CVE:CVE-2025-2485
Description:The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8.7 via deserialization of untrusted input from the 'dnd_upload_cf7_upload'
  function. This makes it possible for attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with the file upload action. The Flamingo plugin must be installed and activated in order to exploit the vulnerability.
published:2025-03-28T07:15:39.450


Instruction: Please provide detailed information about CVE-2025-2074

CVE:CVE-2025-2074
Description:The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries, particularly when the plugin’s settings page hasn’t been visited and its welcome message has not been dismissed. This issue can be used to extract sensitive information from the database.
published:2025-03-28T08:15:15.430


Instruction: Please provide detailed information about CVE-2025-2578

CVE:CVE-2025-2578
Description:The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
published:2025-03-28T08:15:15.603


Instruction: Please provide detailed information about CVE-2025-1705

CVE:CVE-2025-1705
Description:The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-28T09:15:13.917


Instruction: Please provide detailed information about CVE-2025-27567

CVE:CVE-2025-27567
Description:Cross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the configuration page or functions accessible only from the LAN side of the product.
published:2025-03-28T09:15:14.103


Instruction: Please provide detailed information about CVE-2025-27574

CVE:CVE-2025-27574
Description:Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the configuration page or functions accessible only from the LAN side of the product.
published:2025-03-28T09:15:14.347


Instruction: Please provide detailed information about CVE-2025-27716

CVE:CVE-2025-27716
Description:Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.
published:2025-03-28T09:15:14.510


Instruction: Please provide detailed information about CVE-2025-27718

CVE:CVE-2025-27718
Description:Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered or arbitrary code may be executed by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.
published:2025-03-28T09:15:14.667


Instruction: Please provide detailed information about CVE-2025-27726

CVE:CVE-2025-27726
Description:Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.
published:2025-03-28T09:15:14.807


Instruction: Please provide detailed information about CVE-2025-27932

CVE:CVE-2025-27932
Description:Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an attacker may delete a file on the device or cause a denial of service (DoS) condition.
published:2025-03-28T09:15:14.967


Instruction: Please provide detailed information about CVE-2025-27001

CVE:CVE-2025-27001
Description:Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce allows Retrieve Embedded Sensitive Data.This issue affects Shipmondo – A complete shipping solution for WooCommerce: from n/a through 5.0.3.
published:2025-03-28T10:15:15.953


Instruction: Please provide detailed information about CVE-2025-31073

CVE:CVE-2025-31073
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Compete Themes Unlimited allows Stored XSS. This issue affects Unlimited: from n/a through 1.45.
published:2025-03-28T10:15:16.253


Instruction: Please provide detailed information about CVE-2025-31075

CVE:CVE-2025-31075
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments allows Stored XSS. This issue affects MicroPayments: from n/a through 2.9.29.
published:2025-03-28T10:15:16.430


Instruction: Please provide detailed information about CVE-2025-31076

CVE:CVE-2025-31076
Description:Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP allows Server Side Request Forgery. This issue affects WP Compress for MainWP: from n/a through 6.30.03.
published:2025-03-28T10:15:16.610


Instruction: Please provide detailed information about CVE-2025-31077

CVE:CVE-2025-31077
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks allows DOM-Based XSS. This issue affects Ultimate Blocks: from n/a through 3.2.7.
published:2025-03-28T10:15:16.793


Instruction: Please provide detailed information about CVE-2025-31079

CVE:CVE-2025-31079
Description:Cross-Site Request Forgery (CSRF) vulnerability in usermaven Usermaven allows Cross Site Request Forgery. This issue affects Usermaven: from n/a through 1.2.1.
published:2025-03-28T10:15:16.963


Instruction: Please provide detailed information about CVE-2025-31083

CVE:CVE-2025-31083
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall allows Stored XSS. This issue affects Leaky Paywall: from n/a through 4.21.7.
published:2025-03-28T10:15:17.123


Instruction: Please provide detailed information about CVE-2025-31088

CVE:CVE-2025-31088
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions allows Stored XSS. This issue affects Paid Member Subscriptions: from n/a through 2.14.3.
published:2025-03-28T10:15:17.297


Instruction: Please provide detailed information about CVE-2025-31090

CVE:CVE-2025-31090
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector allows Stored XSS. This issue affects Dropdown Multisite selector: from n/a through n/a.
published:2025-03-28T10:15:17.467


Instruction: Please provide detailed information about CVE-2025-31093

CVE:CVE-2025-31093
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content allows DOM-Based XSS. This issue affects RPS Include Content: from n/a through 1.2.1.
published:2025-03-28T10:15:17.640


Instruction: Please provide detailed information about CVE-2025-31094

CVE:CVE-2025-31094
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel allows Stored XSS. This issue affects WP Posts Carousel: from n/a through 1.3.8.
published:2025-03-28T10:15:17.830


Instruction: Please provide detailed information about CVE-2025-31096

CVE:CVE-2025-31096
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX allows DOM-Based XSS. This issue affects PostX: from n/a through 4.1.25.
published:2025-03-28T10:15:18.013


Instruction: Please provide detailed information about CVE-2025-31099

CVE:CVE-2025-31099
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestwebsoft Slider by BestWebSoft allows SQL Injection. This issue affects Slider by BestWebSoft: from n/a through 1.1.0.
published:2025-03-28T10:15:18.193


Instruction: Please provide detailed information about CVE-2025-31102

CVE:CVE-2025-31102
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel allows Reflected XSS. This issue affects Hostel: from n/a through 1.1.5.5.
published:2025-03-28T10:15:18.390


Instruction: Please provide detailed information about CVE-2025-2868

CVE:CVE-2025-2868
Description:Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.
published:2025-03-28T11:15:37.840


Instruction: Please provide detailed information about CVE-2025-2869

CVE:CVE-2025-2869
Description:Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the id parameter in /manage_user.php.
published:2025-03-28T11:15:38.053


Instruction: Please provide detailed information about CVE-2025-2870

CVE:CVE-2025-2870
Description:Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php.
published:2025-03-28T11:15:38.207


Instruction: Please provide detailed information about CVE-2025-2815

CVE:CVE-2025-2815
Description:The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
published:2025-03-28T12:15:15.550


Instruction: Please provide detailed information about CVE-2025-31432

CVE:CVE-2025-31432
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop allows PHP Local File Inclusion. This issue affects Pop-Up Chop Chop: from n/a through 2.1.7.
published:2025-03-28T12:15:15.720


Instruction: Please provide detailed information about CVE-2025-31433

CVE:CVE-2025-31433
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds allows Stored XSS. This issue affects Magic Embeds: from n/a through 3.1.2.
published:2025-03-28T12:15:15.877


Instruction: Please provide detailed information about CVE-2025-31434

CVE:CVE-2025-31434
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Stored XSS. This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.19.
published:2025-03-28T12:15:16.030


Instruction: Please provide detailed information about CVE-2025-31435

CVE:CVE-2025-31435
Description:Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster allows Stored XSS. This issue affects Microblog Poster: from n/a through 2.1.6.
published:2025-03-28T12:15:16.183


Instruction: Please provide detailed information about CVE-2025-31437

CVE:CVE-2025-31437
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Miller WP-OGP allows Stored XSS. This issue affects WP-OGP: from n/a through 1.0.5.
published:2025-03-28T12:15:16.330


Instruction: Please provide detailed information about CVE-2025-31438

CVE:CVE-2025-31438
Description:Cross-Site Request Forgery (CSRF) vulnerability in Benoit De Boeck WP Supersized allows Cross Site Request Forgery. This issue affects WP Supersized: from n/a through 3.1.6.
published:2025-03-28T12:15:16.473


Instruction: Please provide detailed information about CVE-2025-31439

CVE:CVE-2025-31439
Description:Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Caching with .htaccess: from 1.2.1 through n/a.
published:2025-03-28T12:15:16.630


Instruction: Please provide detailed information about CVE-2025-31440

CVE:CVE-2025-31440
Description:Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use allows Stored XSS. This issue affects Terms of Use: from n/a through 2.0.
published:2025-03-28T12:15:16.770


Instruction: Please provide detailed information about CVE-2025-31443

CVE:CVE-2025-31443
Description:Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Furtak KK I Like It allows Stored XSS. This issue affects KK I Like It: from n/a through 1.7.5.3.
published:2025-03-28T12:15:16.927


Instruction: Please provide detailed information about CVE-2025-31444

CVE:CVE-2025-31444
Description:Cross-Site Request Forgery (CSRF) vulnerability in youtag ShowTime Slideshow allows Stored XSS. This issue affects ShowTime Slideshow: from n/a through 1.6.
published:2025-03-28T12:15:17.080


Instruction: Please provide detailed information about CVE-2025-31447

CVE:CVE-2025-31447
Description:Cross-Site Request Forgery (CSRF) vulnerability in nertworks NertWorks All in One Social Share Tools allows Cross Site Request Forgery. This issue affects NertWorks All in One Social Share Tools: from n/a through 1.26.
published:2025-03-28T12:15:17.227


Instruction: Please provide detailed information about CVE-2025-31448

CVE:CVE-2025-31448
Description:Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler allows Cross Site Request Forgery. This issue affects Simple Trackback Disabler: from n/a through 1.4.
published:2025-03-28T12:15:17.377


Instruction: Please provide detailed information about CVE-2025-31449

CVE:CVE-2025-31449
Description:Cross-Site Request Forgery (CSRF) vulnerability in EricH The Visitor Counter allows Stored XSS. This issue affects The Visitor Counter: from n/a through 1.4.3.
published:2025-03-28T12:15:17.527


Instruction: Please provide detailed information about CVE-2025-31450

CVE:CVE-2025-31450
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phantom.omaga Toggle Box allows Stored XSS. This issue affects Toggle Box: from n/a through 1.6.
published:2025-03-28T12:15:17.677


Instruction: Please provide detailed information about CVE-2025-31451

CVE:CVE-2025-31451
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinweber wBounce allows Stored XSS. This issue affects wBounce: from n/a through 1.8.1.
published:2025-03-28T12:15:17.817


Instruction: Please provide detailed information about CVE-2025-31452

CVE:CVE-2025-31452
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search allows Stored XSS. This issue affects WP Ultimate Search: from n/a through 2.0.3.
published:2025-03-28T12:15:17.960


Instruction: Please provide detailed information about CVE-2025-31453

CVE:CVE-2025-31453
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery allows Stored XSS. This issue affects YouTube SimpleGallery: from n/a through 2.0.6.
published:2025-03-28T12:15:18.103


Instruction: Please provide detailed information about CVE-2025-31456

CVE:CVE-2025-31456
Description:Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker allows Cross Site Request Forgery. This issue affects Ultimate Security Checker: from n/a through 4.2.
published:2025-03-28T12:15:18.250


Instruction: Please provide detailed information about CVE-2025-31457

CVE:CVE-2025-31457
Description:Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS allows Cross Site Request Forgery. This issue affects LWS SMS: from n/a through 2.4.1.
published:2025-03-28T12:15:18.393


Instruction: Please provide detailed information about CVE-2025-31458

CVE:CVE-2025-31458
Description:Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder allows Stored XSS. This issue affects Video Embedder: from n/a through 1.7.1.
published:2025-03-28T12:15:18.543


Instruction: Please provide detailed information about CVE-2025-31459

CVE:CVE-2025-31459
Description:Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert allows Stored XSS. This issue affects Login Alert: from n/a through 0.2.1.
published:2025-03-28T12:15:18.680


Instruction: Please provide detailed information about CVE-2025-31460

CVE:CVE-2025-31460
Description:Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager allows Stored XSS. This issue affects OmniLeads Scripts and Tags Manager: from n/a through 1.3.
published:2025-03-28T12:15:18.820


Instruction: Please provide detailed information about CVE-2025-31463

CVE:CVE-2025-31463
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Preetinder Singh TGG WP Optimizer allows Stored XSS. This issue affects TGG WP Optimizer: from n/a through 1.22.
published:2025-03-28T12:15:18.960


Instruction: Please provide detailed information about CVE-2025-31464

CVE:CVE-2025-31464
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color allows Stored XSS. This issue affects Text Selection Color: from n/a through 1.6.
published:2025-03-28T12:15:19.107


Instruction: Please provide detailed information about CVE-2025-31465

CVE:CVE-2025-31465
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in cornershop Better Section Navigation Widget allows Stored XSS. This issue affects Better Section Navigation Widget: from n/a through 1.6.1.
published:2025-03-28T12:15:19.237


Instruction: Please provide detailed information about CVE-2025-31466

CVE:CVE-2025-31466
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Falcon Solutions Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 1.0.
published:2025-03-28T12:15:19.383


Instruction: Please provide detailed information about CVE-2025-31469

CVE:CVE-2025-31469
Description:Missing Authorization vulnerability in webrangers Clear Sucuri Cache allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Clear Sucuri Cache: from n/a through 1.4.
published:2025-03-28T12:15:19.530


Instruction: Please provide detailed information about CVE-2025-31470

CVE:CVE-2025-31470
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover allows Stored XSS. This issue affects Page Takeover: from n/a through 1.1.6.
published:2025-03-28T12:15:19.673


Instruction: Please provide detailed information about CVE-2025-31471

CVE:CVE-2025-31471
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post allows Stored XSS. This issue affects Duplicate Page and Post: from n/a through 1.0.
published:2025-03-28T12:15:19.820


Instruction: Please provide detailed information about CVE-2025-31472

CVE:CVE-2025-31472
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty allows Stored XSS. This issue affects Flatty: from n/a through 2.0.0.
published:2025-03-28T12:15:19.963