Instruction: Please provide detailed information about CVE-2025-27406

CVE:CVE-2025-27406
Description:Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.
published:2025-03-26T16:15:23.147


Instruction: Please provide detailed information about CVE-2025-2098

CVE:CVE-2025-2098
Description:Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5
published:2025-03-26T16:15:23.540


Instruction: Please provide detailed information about CVE-2025-2783

CVE:CVE-2025-2783
Description:Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
published:2025-03-26T16:15:23.693


Instruction: Please provide detailed information about CVE-2025-2825

CVE:CVE-2025-2825
Description:Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage.
published:2025-03-26T16:15:23.883


Instruction: Please provide detailed information about CVE-2025-27609

CVE:CVE-2025-27609
Description:Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.
published:2025-03-26T17:15:25.877


Instruction: Please provide detailed information about CVE-2025-30164

CVE:CVE-2025-30164
Description:Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
published:2025-03-26T17:15:26.560


Instruction: Please provide detailed information about CVE-2025-30217

CVE:CVE-2025-30217
Description:Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.
published:2025-03-26T17:15:26.740


Instruction: Please provide detailed information about CVE-2025-30225

CVE:CVE-2025-30225
Description:Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of malformed transformations. When making many malformed transformation requests at once, at some point, all assets are served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.
published:2025-03-26T17:15:26.917


Instruction: Please provide detailed information about CVE-2025-30350

CVE:CVE-2025-30350
Description:Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of HEAD requests. Some tools use Directus to sync content and assets, and some of those tools use the HEAD method to check the existence of files. When making many HEAD requests at once, at some point, all assets are eventually served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.
published:2025-03-26T17:15:27.093


Instruction: Please provide detailed information about CVE-2025-2499

CVE:CVE-2025-2499
Description:Client side access control bypass in the permission component in  Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions.   This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
published:2025-03-26T18:15:25.720


Instruction: Please provide detailed information about CVE-2025-2528

CVE:CVE-2025-2528
Description:Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to  use a configuration different from the one mandated by the system administrators.      This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
published:2025-03-26T18:15:26.020


Instruction: Please provide detailed information about CVE-2025-2562

CVE:CVE-2025-2562
Description:Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality.        This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
published:2025-03-26T18:15:26.247


Instruction: Please provide detailed information about CVE-2025-2600

CVE:CVE-2025-2600
Description:Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated password to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy".       This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
published:2025-03-26T18:15:26.437


Instruction: Please provide detailed information about CVE-2025-30351

CVE:CVE-2025-30351
Description:Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. One can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires. Version 11.5.0 patches the issue.
published:2025-03-26T18:15:26.873


Instruction: Please provide detailed information about CVE-2025-30352

CVE:CVE-2025-30352
Description:Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. The searchable columns (numbers & strings) are not checked against permissions when injecting the `where` clauses for applying the search query. This leads to the possibility of enumerating those un-permitted fields. Version 11.5.0 fixes the issue.
published:2025-03-26T18:15:27.080


Instruction: Please provide detailed information about CVE-2025-30353

CVE:CVE-2025-30353
Description:Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.
published:2025-03-26T18:15:27.327


Instruction: Please provide detailed information about CVE-2025-25535

CVE:CVE-2025-25535
Description:HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.
published:2025-03-26T19:15:27.030


Instruction: Please provide detailed information about CVE-2025-26001

CVE:CVE-2025-26001
Description:Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword.
published:2025-03-26T19:15:27.133


Instruction: Please provide detailed information about CVE-2025-26002

CVE:CVE-2025-26002
Description:Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost.
published:2025-03-26T19:15:27.230


Instruction: Please provide detailed information about CVE-2025-26003

CVE:CVE-2025-26003
Description:Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest.
published:2025-03-26T19:15:27.320


Instruction: Please provide detailed information about CVE-2025-26004

CVE:CVE-2025-26004
Description:Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns.
published:2025-03-26T19:15:27.413


Instruction: Please provide detailed information about CVE-2025-29322

CVE:CVE-2025-29322
Description:A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted payload to the "Connection Name" in the New Connection and Rename Connection pages.
published:2025-03-26T19:15:27.510


Instruction: Please provide detailed information about CVE-2025-26005

CVE:CVE-2025-26005
Description:Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp.
published:2025-03-26T20:15:21.630


Instruction: Please provide detailed information about CVE-2025-26006

CVE:CVE-2025-26006
Description:Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest.
published:2025-03-26T20:15:21.727


Instruction: Please provide detailed information about CVE-2025-26007

CVE:CVE-2025-26007
Description:Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi.
published:2025-03-26T20:15:21.817


Instruction: Please provide detailed information about CVE-2025-26008

CVE:CVE-2025-26008
Description:In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost.
published:2025-03-26T20:15:21.900


Instruction: Please provide detailed information about CVE-2025-26009

CVE:CVE-2025-26009
Description:Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi.
published:2025-03-26T20:15:21.990


Instruction: Please provide detailed information about CVE-2025-26010

CVE:CVE-2025-26010
Description:Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword.
published:2025-03-26T20:15:22.087


Instruction: Please provide detailed information about CVE-2025-26011

CVE:CVE-2025-26011
Description:Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword.
published:2025-03-26T20:15:22.173


Instruction: Please provide detailed information about CVE-2025-28361

CVE:CVE-2025-28361
Description:Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the systemutil.cgi component.
published:2025-03-26T20:15:22.583


Instruction: Please provide detailed information about CVE-2025-30073

CVE:CVE-2025-30073
Description:An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid.
published:2025-03-26T20:15:22.837


Instruction: Please provide detailed information about CVE-2025-2787

CVE:CVE-2025-2787
Description:KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower.    Besides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub:       *  1.13.3 or above          *  1.12.4 or above          *  1.11.4 or above          *  1.10.4 or above           *
published:2025-03-26T21:15:23.167


Instruction: Please provide detailed information about CVE-2025-31160

CVE:CVE-2025-31160
Description:atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop.
published:2025-03-26T21:15:23.323


Instruction: Please provide detailed information about CVE-2025-20226

CVE:CVE-2025-20226
Description:In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the "/services/streams/search" endpoint through its "q" parameter. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
published:2025-03-26T22:15:14.483


Instruction: Please provide detailed information about CVE-2025-20227

CVE:CVE-2025-20227
Description:In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.
published:2025-03-26T22:15:14.637


Instruction: Please provide detailed information about CVE-2025-20228

CVE:CVE-2025-20228
Description:In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).
published:2025-03-26T22:15:14.783


Instruction: Please provide detailed information about CVE-2025-20229

CVE:CVE-2025-20229
Description:In Splunk Enterprise versions below 9.3.3, 9.2.5,  and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.
published:2025-03-26T22:15:14.933


Instruction: Please provide detailed information about CVE-2025-20231

CVE:CVE-2025-20231
Description:In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.

The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated low-privileged user should not be able to exploit the vulnerability at will.
published:2025-03-26T22:15:15.083


Instruction: Please provide detailed information about CVE-2025-20232

CVE:CVE-2025-20232
Description:In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the “/app/search/search“ endpoint through its “s“ parameter. <br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
published:2025-03-26T22:15:15.233


Instruction: Please provide detailed information about CVE-2025-20233

CVE:CVE-2025-20233
Description:In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-privileged user.
published:2025-03-26T22:15:15.390


Instruction: Please provide detailed information about CVE-2025-2837

CVE:CVE-2025-2837
Description:Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.  The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23245.
published:2025-03-26T22:15:15.660


Instruction: Please provide detailed information about CVE-2025-2838

CVE:CVE-2025-2838
Description:Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.  The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.
published:2025-03-26T22:15:15.803


Instruction: Please provide detailed information about CVE-2025-30407

CVE:CVE-2025-30407
Description:Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39713.
published:2025-03-26T22:15:15.943


Instruction: Please provide detailed information about CVE-2025-20230

CVE:CVE-2025-20230
Description:In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value Store (KVStore) collections that the Splunk Secure Gateway app created. This is due to missing access control and incorrect ownership of the data in those KVStore collections.

In the affected versions, the `nobody` user owned the data in the KVStore collections. This meant that there was no specific owner assigned to the data in those collections.
published:2025-03-26T23:15:18.140


Instruction: Please provide detailed information about CVE-2025-2496

CVE:CVE-2025-2496
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-26T23:15:18.717


Instruction: Please provide detailed information about CVE-2025-30355

CVE:CVE-2025-30355
Description:Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
published:2025-03-27T01:15:12.500


Instruction: Please provide detailed information about CVE-2025-2481

CVE:CVE-2025-2481
Description:The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-27T02:15:16.053


Instruction: Please provide detailed information about CVE-2025-2831

CVE:CVE-2025-2831
Description:A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T03:15:14.080


Instruction: Please provide detailed information about CVE-2025-2832

CVE:CVE-2025-2832
Description:A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T04:15:21.717


Instruction: Please provide detailed information about CVE-2025-2833

CVE:CVE-2025-2833
Description:A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T04:15:23.847


Instruction: Please provide detailed information about CVE-2025-2835

CVE:CVE-2025-2835
Description:A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T04:15:25.520


Instruction: Please provide detailed information about CVE-2025-31105

CVE:CVE-2025-31105
Description:Rejected reason: Not used
published:2025-03-27T04:15:27.447


Instruction: Please provide detailed information about CVE-2025-31106

CVE:CVE-2025-31106
Description:Rejected reason: Not used
published:2025-03-27T04:15:28.007


Instruction: Please provide detailed information about CVE-2025-31107

CVE:CVE-2025-31107
Description:Rejected reason: Not used
published:2025-03-27T04:15:28.073


Instruction: Please provide detailed information about CVE-2025-31108

CVE:CVE-2025-31108
Description:Rejected reason: Not used
published:2025-03-27T04:15:28.140


Instruction: Please provide detailed information about CVE-2025-31109

CVE:CVE-2025-31109
Description:Rejected reason: Not used
published:2025-03-27T04:15:28.717


Instruction: Please provide detailed information about CVE-2025-31110

CVE:CVE-2025-31110
Description:Rejected reason: Not used
published:2025-03-27T04:15:28.787


Instruction: Please provide detailed information about CVE-2025-31111

CVE:CVE-2025-31111
Description:Rejected reason: Not used
published:2025-03-27T04:15:29.310


Instruction: Please provide detailed information about CVE-2025-31112

CVE:CVE-2025-31112
Description:Rejected reason: Not used
published:2025-03-27T04:15:29.427


Instruction: Please provide detailed information about CVE-2025-31113

CVE:CVE-2025-31113
Description:Rejected reason: Not used
published:2025-03-27T04:15:29.493


Instruction: Please provide detailed information about CVE-2025-31165

CVE:CVE-2025-31165
Description:Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.
published:2025-03-27T04:15:29.567


Instruction: Please provide detailed information about CVE-2025-0273

CVE:CVE-2025-0273
Description:HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.
published:2025-03-27T05:15:38.237


Instruction: Please provide detailed information about CVE-2025-2332

CVE:CVE-2025-2332
Description:The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
published:2025-03-27T06:15:28.180


Instruction: Please provide detailed information about CVE-2025-2685

CVE:CVE-2025-2685
Description:The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-27T06:15:29.550


Instruction: Please provide detailed information about CVE-2025-29993

CVE:CVE-2025-29993
Description:The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.
published:2025-03-27T10:15:14.063


Instruction: Please provide detailed information about CVE-2025-30763

CVE:CVE-2025-30763
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP allows Stored XSS. This issue affects EO4WP: from n/a through 1.0.8.4.
published:2025-03-27T11:15:37.123


Instruction: Please provide detailed information about CVE-2025-30764

CVE:CVE-2025-30764
Description:Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool allows Cross Site Request Forgery. This issue affects Football Pool: from n/a through 2.12.2.
published:2025-03-27T11:15:37.280


Instruction: Please provide detailed information about CVE-2025-30765

CVE:CVE-2025-30765
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock allows Blind SQL Injection. This issue affects FlexStock: from n/a through 3.13.1.
published:2025-03-27T11:15:37.410


Instruction: Please provide detailed information about CVE-2025-30766

CVE:CVE-2025-30766
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor allows DOM-Based XSS. This issue affects Happy Addons for Elementor: from n/a through 3.16.2.
published:2025-03-27T11:15:37.550


Instruction: Please provide detailed information about CVE-2025-30767

CVE:CVE-2025-30767
Description:Missing Authorization vulnerability in add-ons.org PDF for WPForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for WPForms: from n/a through 5.3.0.
published:2025-03-27T11:15:37.690


Instruction: Please provide detailed information about CVE-2025-30768

CVE:CVE-2025-30768
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge allows Stored XSS. This issue affects jAlbum Bridge: from n/a through 2.0.18.
published:2025-03-27T11:15:37.830


Instruction: Please provide detailed information about CVE-2025-30769

CVE:CVE-2025-30769
Description:Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite allows Stored XSS. This issue affects WIP WooCarousel Lite: from n/a through 1.1.7.
published:2025-03-27T11:15:37.970


Instruction: Please provide detailed information about CVE-2025-30770

CVE:CVE-2025-30770
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable allows DOM-Based XSS. This issue affects Charitable: from n/a through 1.8.4.7.
published:2025-03-27T11:15:38.113


Instruction: Please provide detailed information about CVE-2025-30771

CVE:CVE-2025-30771
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify allows DOM-Based XSS. This issue affects WP Cassify: from n/a through 2.3.5.
published:2025-03-27T11:15:38.253


Instruction: Please provide detailed information about CVE-2025-30772

CVE:CVE-2025-30772
Description:Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce allows Privilege Escalation. This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through 3.0.4.
published:2025-03-27T11:15:38.397


Instruction: Please provide detailed information about CVE-2025-30773

CVE:CVE-2025-30773
Description:Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress allows Object Injection. This issue affects TranslatePress: from n/a through 2.9.6.
published:2025-03-27T11:15:38.537


Instruction: Please provide detailed information about CVE-2025-30775

CVE:CVE-2025-30775
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy allows SQL Injection. This issue affects WPGuppy: from n/a through 1.1.3.
published:2025-03-27T11:15:38.673


Instruction: Please provide detailed information about CVE-2025-30776

CVE:CVE-2025-30776
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit allows Stored XSS. This issue affects Sitekit: from n/a through 1.8.
published:2025-03-27T11:15:38.803


Instruction: Please provide detailed information about CVE-2025-30777

CVE:CVE-2025-30777
Description:Authorization Bypass Through User-Controlled Key vulnerability in PalsCode Support Genix allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Support Genix: from n/a through 1.4.11.
published:2025-03-27T11:15:38.930


Instruction: Please provide detailed information about CVE-2025-30779

CVE:CVE-2025-30779
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Doneren met Mollie allows Stored XSS. This issue affects Doneren met Mollie: from n/a through 2.10.7.
published:2025-03-27T11:15:39.060


Instruction: Please provide detailed information about CVE-2025-30780

CVE:CVE-2025-30780
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album allows Stored XSS. This issue affects Audio Album: from n/a through 1.5.0.
published:2025-03-27T11:15:39.193


Instruction: Please provide detailed information about CVE-2025-30781

CVE:CVE-2025-30781
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce allows Phishing. This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through 3.7.1.
published:2025-03-27T11:15:39.320


Instruction: Please provide detailed information about CVE-2025-30783

CVE:CVE-2025-30783
Description:Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider allows SQL Injection. This issue affects WP Google Review Slider: from n/a through 16.0.
published:2025-03-27T11:15:39.447


Instruction: Please provide detailed information about CVE-2025-30784

CVE:CVE-2025-30784
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Shuffle WP Subscription Forms allows SQL Injection. This issue affects WP Subscription Forms: from n/a through 1.2.3.
published:2025-03-27T11:15:39.577


Instruction: Please provide detailed information about CVE-2025-30785

CVE:CVE-2025-30785
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite allows PHP Local File Inclusion. This issue affects Subscribe to Download Lite: from n/a through 1.2.9.
published:2025-03-27T11:15:39.703


Instruction: Please provide detailed information about CVE-2025-30786

CVE:CVE-2025-30786
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama allows DOM-Based XSS. This issue affects Quotes llama: from n/a through 3.1.0.
published:2025-03-27T11:15:39.833


Instruction: Please provide detailed information about CVE-2025-30787

CVE:CVE-2025-30787
Description:Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup allows Stored XSS. This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through 5.25.08.
published:2025-03-27T11:15:39.963


Instruction: Please provide detailed information about CVE-2025-30788

CVE:CVE-2025-30788
Description:Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup allows SQL Injection. This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through 5.25.08.
published:2025-03-27T11:15:40.093


Instruction: Please provide detailed information about CVE-2025-30789

CVE:CVE-2025-30789
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator allows Stored XSS. This issue affects Clearout Email Validator: from n/a through 3.2.0.
published:2025-03-27T11:15:40.223


Instruction: Please provide detailed information about CVE-2025-30790

CVE:CVE-2025-30790
Description:Missing Authorization vulnerability in alexvtn Chatbox Manager allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Chatbox Manager: from n/a through 1.2.2.
published:2025-03-27T11:15:40.357


Instruction: Please provide detailed information about CVE-2025-30791

CVE:CVE-2025-30791
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce allows SQL Injection. This issue affects Cart tracking for WooCommerce: from n/a through 1.0.16.
published:2025-03-27T11:15:40.490


Instruction: Please provide detailed information about CVE-2025-30792

CVE:CVE-2025-30792
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zumbo Comment Approved Notifier Extended allows Stored XSS. This issue affects Comment Approved Notifier Extended: from n/a through 5.2.
published:2025-03-27T11:15:40.620


Instruction: Please provide detailed information about CVE-2025-30795

CVE:CVE-2025-30795
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FunnelKit Automation By Autonami allows Phishing. This issue affects Automation By Autonami: from n/a through 3.5.1.
published:2025-03-27T11:15:40.753


Instruction: Please provide detailed information about CVE-2025-30799

CVE:CVE-2025-30799
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View allows Stored XSS. This issue affects WP Google Street View: from n/a through 1.1.5.
published:2025-03-27T11:15:40.883


Instruction: Please provide detailed information about CVE-2025-30800

CVE:CVE-2025-30800
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon allows Stored XSS. This issue affects Gum Elementor Addon: from n/a through 1.3.10.
published:2025-03-27T11:15:41.017


Instruction: Please provide detailed information about CVE-2025-30801

CVE:CVE-2025-30801
Description:Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews allows Cross Site Request Forgery. This issue affects TWB Woocommerce Reviews: from n/a through 1.7.7.
published:2025-03-27T11:15:41.157


Instruction: Please provide detailed information about CVE-2025-30803

CVE:CVE-2025-30803
Description:Missing Authorization vulnerability in Greg Ross Just Writing Statistics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Just Writing Statistics: from n/a through 5.3.
published:2025-03-27T11:15:41.297


Instruction: Please provide detailed information about CVE-2025-30804

CVE:CVE-2025-30804
Description:Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI allows Cross Site Request Forgery. This issue affects wpShopGermany IT-RECHT KANZLEI: from n/a through 2.0.
published:2025-03-27T11:15:41.440


Instruction: Please provide detailed information about CVE-2025-30805

CVE:CVE-2025-30805
Description:Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies allows Cross Site Request Forgery. This issue affects Flexible Cookies: from n/a through 1.1.8.
published:2025-03-27T11:15:41.573


Instruction: Please provide detailed information about CVE-2025-30806

CVE:CVE-2025-30806
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Constantin Boiangiu Vimeotheque allows SQL Injection. This issue affects Vimeotheque: from n/a through 2.3.4.2.
published:2025-03-27T11:15:41.703


Instruction: Please provide detailed information about CVE-2025-30809

CVE:CVE-2025-30809
Description:Missing Authorization vulnerability in Shahjada Live Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Live Forms: from n/a through 4.8.4.
published:2025-03-27T11:15:41.837


Instruction: Please provide detailed information about CVE-2025-30810

CVE:CVE-2025-30810
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smackcoders Lead Form Data Collection to CRM allows Blind SQL Injection. This issue affects Lead Form Data Collection to CRM: from n/a through 3.0.1.
published:2025-03-27T11:15:41.970


Instruction: Please provide detailed information about CVE-2025-30811

CVE:CVE-2025-30811
Description:Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify allows Cross Site Request Forgery. This issue affects ValidateCertify: from n/a through 1.6.1.
published:2025-03-27T11:15:42.103


Instruction: Please provide detailed information about CVE-2025-30812

CVE:CVE-2025-30812
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor allows Stored XSS. This issue affects SKT Addons for Elementor: from n/a through 3.5.
published:2025-03-27T11:15:42.237


Instruction: Please provide detailed information about CVE-2025-30813

CVE:CVE-2025-30813
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester allows Stored XSS. This issue affects Listamester: from n/a through 2.3.5.
published:2025-03-27T11:15:42.370


Instruction: Please provide detailed information about CVE-2025-30814

CVE:CVE-2025-30814
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid allows PHP Local File Inclusion. This issue affects The Post Grid: from n/a through 7.7.17.
published:2025-03-27T11:15:42.503


Instruction: Please provide detailed information about CVE-2025-30815

CVE:CVE-2025-30815
Description:Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting allows Cross Site Request Forgery. This issue affects Hesabfa Accounting: from n/a through 2.1.8.
published:2025-03-27T11:15:42.640


Instruction: Please provide detailed information about CVE-2025-30816

CVE:CVE-2025-30816
Description:Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification allows Cross Site Request Forgery. This issue affects publish post email notification: from n/a through 1.0.2.3.
published:2025-03-27T11:15:42.773


Instruction: Please provide detailed information about CVE-2025-30817

CVE:CVE-2025-30817
Description:Missing Authorization vulnerability in wpzita Z Companion allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Z Companion: from n/a through 1.0.13.
published:2025-03-27T11:15:42.907


Instruction: Please provide detailed information about CVE-2025-30818

CVE:CVE-2025-30818
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge allows DOM-Based XSS. This issue affects jAlbum Bridge: from n/a through 2.0.17.
published:2025-03-27T11:15:43.047


Instruction: Please provide detailed information about CVE-2025-30819

CVE:CVE-2025-30819
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Igor Benic Simple Giveaways allows SQL Injection. This issue affects Simple Giveaways: from n/a through 2.48.1.
published:2025-03-27T11:15:43.183


Instruction: Please provide detailed information about CVE-2025-30820

CVE:CVE-2025-30820
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite allows PHP Local File Inclusion. This issue affects WishSuite: from n/a through 1.4.4.
published:2025-03-27T11:15:43.320


Instruction: Please provide detailed information about CVE-2025-30821

CVE:CVE-2025-30821
Description:Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects SNORDIAN's H5PxAPIkatchu: from n/a through 0.4.14.
published:2025-03-27T11:15:43.453


Instruction: Please provide detailed information about CVE-2025-30822

CVE:CVE-2025-30822
Description:Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zaman Custom Login Logo allows Cross Site Request Forgery. This issue affects Custom Login Logo: from n/a through 1.1.7.
published:2025-03-27T11:15:43.583


Instruction: Please provide detailed information about CVE-2025-30823

CVE:CVE-2025-30823
Description:Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize allows Cross Site Request Forgery. This issue affects Anthologize: from n/a through 0.8.2.
published:2025-03-27T11:15:43.713


Instruction: Please provide detailed information about CVE-2025-30824

CVE:CVE-2025-30824
Description:Missing Authorization vulnerability in Israpil Textmetrics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Textmetrics: from n/a through 3.6.1.
published:2025-03-27T11:15:43.847


Instruction: Please provide detailed information about CVE-2025-30826

CVE:CVE-2025-30826
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator allows DOM-Based XSS. This issue affects IP Locator: from n/a through 4.1.0.
published:2025-03-27T11:15:43.980


Instruction: Please provide detailed information about CVE-2025-30828

CVE:CVE-2025-30828
Description:Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.29.
published:2025-03-27T11:15:44.117


Instruction: Please provide detailed information about CVE-2025-30829

CVE:CVE-2025-30829
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion. This issue affects WPCafe: from n/a through 2.2.31.
published:2025-03-27T11:15:44.257


Instruction: Please provide detailed information about CVE-2025-30830

CVE:CVE-2025-30830
Description:Missing Authorization vulnerability in Hossni Mubarak Cool Author Box allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cool Author Box: from n/a through 2.9.9.
published:2025-03-27T11:15:44.390


Instruction: Please provide detailed information about CVE-2025-30831

CVE:CVE-2025-30831
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post allows PHP Local File Inclusion. This issue affects Themify Event Post: from n/a through 1.3.2.
published:2025-03-27T11:15:44.520


Instruction: Please provide detailed information about CVE-2025-30832

CVE:CVE-2025-30832
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post allows DOM-Based XSS. This issue affects Themify Event Post: from n/a through 1.3.2.
published:2025-03-27T11:15:44.653


Instruction: Please provide detailed information about CVE-2025-30833

CVE:CVE-2025-30833
Description:Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D allows Cross Site Request Forgery. This issue affects Verge3D: from n/a through 4.8.2.
published:2025-03-27T11:15:44.793


Instruction: Please provide detailed information about CVE-2025-30836

CVE:CVE-2025-30836
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint allows Stored XSS. This issue affects LatePoint: from n/a through 5.1.6.
published:2025-03-27T11:15:44.930


Instruction: Please provide detailed information about CVE-2025-30838

CVE:CVE-2025-30838
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks allows Stored XSS. This issue affects Cozy Blocks: from n/a through 2.1.6.
published:2025-03-27T11:15:45.060


Instruction: Please provide detailed information about CVE-2025-30839

CVE:CVE-2025-30839
Description:Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 1.2.1.
published:2025-03-27T11:15:45.193


Instruction: Please provide detailed information about CVE-2025-30842

CVE:CVE-2025-30842
Description:Cross-Site Request Forgery (CSRF) vulnerability in pixolette Christmas Panda allows Cross Site Request Forgery. This issue affects Christmas Panda: from n/a through 1.0.4.
published:2025-03-27T11:15:45.340


Instruction: Please provide detailed information about CVE-2025-30843

CVE:CVE-2025-30843
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web allows SQL Injection. This issue affects bizcalendar-web: from n/a through 1.1.0.34.
published:2025-03-27T11:15:45.490


Instruction: Please provide detailed information about CVE-2025-30845

CVE:CVE-2025-30845
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webangon The Pack Elementor addons allows PHP Local File Inclusion. This issue affects The Pack Elementor addons: from n/a through 2.1.1.
published:2025-03-27T11:15:45.643


Instruction: Please provide detailed information about CVE-2025-30846

CVE:CVE-2025-30846
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress allows PHP Local File Inclusion. This issue affects Restaurant Menu by MotoPress: from n/a through 2.4.4.
published:2025-03-27T11:15:45.787


Instruction: Please provide detailed information about CVE-2025-30847

CVE:CVE-2025-30847
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist allows Stored XSS. This issue affects Novelist: from n/a through 1.2.3.
published:2025-03-27T11:15:45.923


Instruction: Please provide detailed information about CVE-2025-30850

CVE:CVE-2025-30850
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex allows Stored XSS. This issue affects Dr. Flex: from n/a through 2.0.0.
published:2025-03-27T11:15:46.067


Instruction: Please provide detailed information about CVE-2025-30851

CVE:CVE-2025-30851
Description:Missing Authorization vulnerability in Tickera Tickera allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tickera: from n/a through 3.5.5.2.
published:2025-03-27T11:15:46.217


Instruction: Please provide detailed information about CVE-2025-30854

CVE:CVE-2025-30854
Description:Cross-Site Request Forgery (CSRF) vulnerability in Saso Serial Codes Generator and Validator with WooCommerce Support allows Cross Site Request Forgery. This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through 2.7.7.
published:2025-03-27T11:15:46.390


Instruction: Please provide detailed information about CVE-2025-30856

CVE:CVE-2025-30856
Description:Cross-Site Request Forgery (CSRF) vulnerability in theme funda Custom Field For WP Job Manager allows Cross Site Request Forgery. This issue affects Custom Field For WP Job Manager: from n/a through 1.4.
published:2025-03-27T11:15:46.547


Instruction: Please provide detailed information about CVE-2025-30857

CVE:CVE-2025-30857
Description:Cross-Site Request Forgery (CSRF) vulnerability in PressMaximum Currency Switcher for WooCommerce allows Stored XSS. This issue affects Currency Switcher for WooCommerce: from n/a through 0.0.7.
published:2025-03-27T11:15:46.700


Instruction: Please provide detailed information about CVE-2025-30859

CVE:CVE-2025-30859
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ali2woo AliNext allows Phishing. This issue affects AliNext: from n/a through 3.5.1.
published:2025-03-27T11:15:46.843


Instruction: Please provide detailed information about CVE-2025-30860

CVE:CVE-2025-30860
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) allows DOM-Based XSS. This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through 0.5.8.2.
published:2025-03-27T11:15:46.983


Instruction: Please provide detailed information about CVE-2025-30861

CVE:CVE-2025-30861
Description:Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.6.29.
published:2025-03-27T11:15:47.130


Instruction: Please provide detailed information about CVE-2025-30862

CVE:CVE-2025-30862
Description:Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi reCAPTCHA for all allows Cross Site Request Forgery. This issue affects reCAPTCHA for all: from n/a through 2.22.
published:2025-03-27T11:15:47.273


Instruction: Please provide detailed information about CVE-2025-30863

CVE:CVE-2025-30863
Description:Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms allows Cross Site Request Forgery. This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.0.9.
published:2025-03-27T11:15:47.410


Instruction: Please provide detailed information about CVE-2025-30864

CVE:CVE-2025-30864
Description:Missing Authorization vulnerability in falselight Exchange Rates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Exchange Rates: from n/a through 1.2.2.
published:2025-03-27T11:15:47.550


Instruction: Please provide detailed information about CVE-2025-30865

CVE:CVE-2025-30865
Description:Cross-Site Request Forgery (CSRF) vulnerability in fuzzoid 3DPrint Lite allows Cross Site Request Forgery. This issue affects 3DPrint Lite: from n/a through 2.1.3.5.
published:2025-03-27T11:15:47.683


Instruction: Please provide detailed information about CVE-2025-30866

CVE:CVE-2025-30866
Description:Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Terms & Conditions Per Product: from n/a through 1.2.15.
published:2025-03-27T11:15:47.820


Instruction: Please provide detailed information about CVE-2025-30867

CVE:CVE-2025-30867
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ allows Stored XSS. This issue affects SearchIQ: from n/a through 4.7.
published:2025-03-27T11:15:47.960


Instruction: Please provide detailed information about CVE-2025-30868

CVE:CVE-2025-30868
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DynamicWebLab Team Manager allows PHP Local File Inclusion. This issue affects Team Manager: from n/a through 2.1.23.
published:2025-03-27T11:15:48.103


Instruction: Please provide detailed information about CVE-2025-30871

CVE:CVE-2025-30871
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.3.5.
published:2025-03-27T11:15:48.243


Instruction: Please provide detailed information about CVE-2025-30872

CVE:CVE-2025-30872
Description:Cross-Site Request Forgery (CSRF) vulnerability in Nitin Prakash Product Author for WooCommerce allows Cross Site Request Forgery. This issue affects Product Author for WooCommerce: from n/a through 1.0.7.
published:2025-03-27T11:15:48.383


Instruction: Please provide detailed information about CVE-2025-30873

CVE:CVE-2025-30873
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS. This issue affects Greenshift: from n/a through 11.0.2.
published:2025-03-27T11:15:48.523


Instruction: Please provide detailed information about CVE-2025-30874

CVE:CVE-2025-30874
Description:Missing Authorization vulnerability in Jose Specific Content For Mobile allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Specific Content For Mobile: from n/a through 0.5.3.
published:2025-03-27T11:15:48.663


Instruction: Please provide detailed information about CVE-2025-30877

CVE:CVE-2025-30877
Description:Missing Authorization vulnerability in fatcatapps Quiz Cat allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Quiz Cat: from n/a through 3.0.8.
published:2025-03-27T11:15:48.803


Instruction: Please provide detailed information about CVE-2025-30879

CVE:CVE-2025-30879
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in moreconvert MC Woocommerce Wishlist allows SQL Injection. This issue affects MC Woocommerce Wishlist: from n/a through 1.8.9.
published:2025-03-27T11:15:48.940


Instruction: Please provide detailed information about CVE-2025-30881

CVE:CVE-2025-30881
Description:Missing Authorization vulnerability in ThemeHunk Big Store allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Big Store: from n/a through 2.0.8.
published:2025-03-27T11:15:49.080


Instruction: Please provide detailed information about CVE-2025-30883

CVE:CVE-2025-30883
Description:Missing Authorization vulnerability in richplugins Trust.Reviews allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Trust.Reviews: from n/a through 2.3.
published:2025-03-27T11:15:49.220


Instruction: Please provide detailed information about CVE-2025-30884

CVE:CVE-2025-30884
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations allows Phishing. This issue affects Bit Integrations: from n/a through 2.4.10.
published:2025-03-27T11:15:49.357


Instruction: Please provide detailed information about CVE-2025-30885

CVE:CVE-2025-30885
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form – Contact Form Plugin allows Phishing. This issue affects Bit Form – Contact Form Plugin: from n/a through 2.18.0.
published:2025-03-27T11:15:49.493


Instruction: Please provide detailed information about CVE-2025-30887

CVE:CVE-2025-30887
Description:Missing Authorization vulnerability in magepeopleteam WpEvently allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpEvently: from n/a through 4.2.9.
published:2025-03-27T11:15:49.633


Instruction: Please provide detailed information about CVE-2025-30888

CVE:CVE-2025-30888
Description:Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce allows Cross Site Request Forgery. This issue affects Custom Fields Account Registration For Woocommerce: from n/a through 1.1.
published:2025-03-27T11:15:49.773


Instruction: Please provide detailed information about CVE-2025-30890

CVE:CVE-2025-30890
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SuitePlugins Login Widget for Ultimate Member allows PHP Local File Inclusion. This issue affects Login Widget for Ultimate Member: from n/a through 1.1.2.
published:2025-03-27T11:15:49.920


Instruction: Please provide detailed information about CVE-2025-30891

CVE:CVE-2025-30891
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly allows PHP Local File Inclusion. This issue affects WpTravelly: from n/a through 1.8.7.
published:2025-03-27T11:15:50.057


Instruction: Please provide detailed information about CVE-2025-30893

CVE:CVE-2025-30893
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector allows DOM-Based XSS. This issue affects LeadConnector: from n/a through 3.0.2.
published:2025-03-27T11:15:50.190


Instruction: Please provide detailed information about CVE-2025-30894

CVE:CVE-2025-30894
Description:Missing Authorization vulnerability in Epsiloncool WP Fast Total Search allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Fast Total Search: from n/a through 1.79.262.
published:2025-03-27T11:15:50.333


Instruction: Please provide detailed information about CVE-2025-30895

CVE:CVE-2025-30895
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently allows PHP Local File Inclusion. This issue affects WpEvently: from n/a through 4.2.9.
published:2025-03-27T11:15:50.470


Instruction: Please provide detailed information about CVE-2025-30896

CVE:CVE-2025-30896
Description:Missing Authorization vulnerability in weDevs WP ERP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP ERP: from n/a through 1.13.4.
published:2025-03-27T11:15:50.623


Instruction: Please provide detailed information about CVE-2025-30897

CVE:CVE-2025-30897
Description:Missing Authorization vulnerability in Adnan Analytify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Analytify: from n/a through 5.5.1.
published:2025-03-27T11:15:50.777


Instruction: Please provide detailed information about CVE-2025-30898

CVE:CVE-2025-30898
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) allows Stored XSS. This issue affects افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری): from n/a through 4.2.3.
published:2025-03-27T11:15:50.920


Instruction: Please provide detailed information about CVE-2025-30899

CVE:CVE-2025-30899
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration allows Stored XSS. This issue affects User Registration: from n/a through 4.0.3.
published:2025-03-27T11:15:51.060


Instruction: Please provide detailed information about CVE-2025-30900

CVE:CVE-2025-30900
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0.
published:2025-03-27T11:15:51.200


Instruction: Please provide detailed information about CVE-2025-30903

CVE:CVE-2025-30903
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved allows DOM-Based XSS. This issue affects SyntaxHighlighter Evolved: from n/a through 3.7.1.
published:2025-03-27T11:15:51.340


Instruction: Please provide detailed information about CVE-2025-30904

CVE:CVE-2025-30904
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify allows Stored XSS. This issue affects Chartify: from n/a through 3.1.7.
published:2025-03-27T11:15:51.480


Instruction: Please provide detailed information about CVE-2025-30907

CVE:CVE-2025-30907
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free allows DOM-Based XSS. This issue affects SecuPress Free: from n/a through 2.2.5.3.
published:2025-03-27T11:15:51.620


Instruction: Please provide detailed information about CVE-2025-30909

CVE:CVE-2025-30909
Description:Missing Authorization vulnerability in Conversios Conversios.io allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Conversios.io: from n/a through 7.2.3.
published:2025-03-27T11:15:51.773


Instruction: Please provide detailed information about CVE-2025-30912

CVE:CVE-2025-30912
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Float menu allows Cross Site Request Forgery. This issue affects Float menu: from n/a through 6.1.2.
published:2025-03-27T11:15:51.953


Instruction: Please provide detailed information about CVE-2025-30914

CVE:CVE-2025-30914
Description:Server-Side Request Forgery (SSRF) vulnerability in XpeedStudio Metform allows Server Side Request Forgery. This issue affects Metform: from n/a through 3.9.2.
published:2025-03-27T11:15:52.130


Instruction: Please provide detailed information about CVE-2025-30918

CVE:CVE-2025-30918
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codemacher Structured Content allows Stored XSS. This issue affects Structured Content: from n/a through 1.6.3.
published:2025-03-27T11:15:52.277


Instruction: Please provide detailed information about CVE-2025-30919

CVE:CVE-2025-30919
Description:Cross-Site Request Forgery (CSRF) vulnerability in Store Locator Widgets Store Locator Widget allows Stored XSS. This issue affects Store Locator Widget: from n/a through 20200131.
published:2025-03-27T11:15:52.477


Instruction: Please provide detailed information about CVE-2025-30920

CVE:CVE-2025-30920
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel allows Stored XSS. This issue affects WP Posts Carousel: from n/a through 1.3.7.
published:2025-03-27T11:15:52.633


Instruction: Please provide detailed information about CVE-2025-30921

CVE:CVE-2025-30921
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters allows SQL Injection. This issue affects Newsletters: from n/a through 4.9.9.7.
published:2025-03-27T11:15:52.770


Instruction: Please provide detailed information about CVE-2025-30922

CVE:CVE-2025-30922
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder allows Stored XSS. This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through 1.1.1.
published:2025-03-27T11:15:52.917


Instruction: Please provide detailed information about CVE-2025-30923

CVE:CVE-2025-30923
Description:Cross-Site Request Forgery (CSRF) vulnerability in powerfulwp Gift Message for WooCommerce allows Cross Site Request Forgery. This issue affects Gift Message for WooCommerce: from n/a through 1.7.8.
published:2025-03-27T11:15:53.053


Instruction: Please provide detailed information about CVE-2025-30925

CVE:CVE-2025-30925
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons allows Stored XSS. This issue affects The Pack Elementor addons: from n/a through 2.1.1.
published:2025-03-27T11:15:53.207


Instruction: Please provide detailed information about CVE-2025-31139

CVE:CVE-2025-31139
Description:In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
published:2025-03-27T12:15:14.660


Instruction: Please provide detailed information about CVE-2025-31140

CVE:CVE-2025-31140
Description:In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
published:2025-03-27T12:15:14.860


Instruction: Please provide detailed information about CVE-2025-31141

CVE:CVE-2025-31141
Description:In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
published:2025-03-27T12:15:15.050


Instruction: Please provide detailed information about CVE-2025-0811

CVE:CVE-2025-0811
Description:An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.
published:2025-03-27T13:15:36.237


Instruction: Please provide detailed information about CVE-2025-2242

CVE:CVE-2025-2242
Description:An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.
published:2025-03-27T13:15:36.387


Instruction: Please provide detailed information about CVE-2025-2255

CVE:CVE-2025-2255
Description:An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.
published:2025-03-27T13:15:36.520


Instruction: Please provide detailed information about CVE-2025-2846

CVE:CVE-2025-2846
Description:A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects the function registration of the file /oews/classes/Users.php?f=registration of the component Registration. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T13:15:36.663


Instruction: Please provide detailed information about CVE-2025-2847

CVE:CVE-2025-2847
Description:A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown processing of the file /dashboard/admin/over_month.php. The manipulation of the argument mm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T13:15:37.030


Instruction: Please provide detailed information about CVE-2025-21867

CVE:CVE-2025-21867
Description:In the Linux kernel, the following vulnerability has been resolved:  bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()  KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't contain an Ethernet header. This occurs when bpf_prog_test_run_xdp() passes an invalid value as the user_data argument to bpf_test_init().  Fix this by returning an error when user_data is less than ETH_HLEN in bpf_test_init(). Additionally, remove the check for "if (user_size > size)" as it is unnecessary.  [1] BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165  eth_skb_pkt_type include/linux/etherdevice.h:627 [inline]  eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165  __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635  xdp_recv_frames net/bpf/test_run.c:272 [inline]  xdp_test_run_batch net/bpf/test_run.c:361 [inline]  bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390  bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318  bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371  __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777  __do_sys_bpf kernel/bpf/syscall.c:5866 [inline]  __se_sys_bpf kernel/bpf/syscall.c:5864 [inline]  __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864  x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Uninit was created at:  free_pages_prepare mm/page_alloc.c:1056 [inline]  free_unref_page+0x156/0x1320 mm/page_alloc.c:2657  __free_pages+0xa3/0x1b0 mm/page_alloc.c:4838  bpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline]  ringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235  bpf_map_free kernel/bpf/syscall.c:838 [inline]  bpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862  process_one_work kernel/workqueue.c:3229 [inline]  process_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310  worker_thread+0xedf/0x1550 kernel/workqueue.c:3391  kthread+0x535/0x6b0 kernel/kthread.c:389  ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244  CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
published:2025-03-27T14:15:47.750


Instruction: Please provide detailed information about CVE-2025-21868

CVE:CVE-2025-21868
Description:In the Linux kernel, the following vulnerability has been resolved:  net: allow small head cache usage with large MAX_SKB_FRAGS values  Sabrina reported the following splat:      WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0     Modules linked in:     CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014     RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0     Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48     RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e     RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6     RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c     R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168     R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007     FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     Call Trace:     <TASK>     gro_cells_init+0x1ba/0x270     xfrm_input_init+0x4b/0x2a0     xfrm_init+0x38/0x50     ip_rt_init+0x2d7/0x350     ip_init+0xf/0x20     inet_init+0x406/0x590     do_one_initcall+0x9d/0x2e0     do_initcalls+0x23b/0x280     kernel_init_freeable+0x445/0x490     kernel_init+0x20/0x1d0     ret_from_fork+0x46/0x80     ret_from_fork_asm+0x1a/0x30     </TASK>     irq event stamp: 584330     hardirqs last  enabled at (584338): [<ffffffff8168bf87>] __up_console_sem+0x77/0xb0     hardirqs last disabled at (584345): [<ffffffff8168bf6c>] __up_console_sem+0x5c/0xb0     softirqs last  enabled at (583242): [<ffffffff833ee96d>] netlink_insert+0x14d/0x470     softirqs last disabled at (583754): [<ffffffff8317c8cd>] netif_napi_add_weight_locked+0x77d/0xba0  on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024) is smaller than GRO_MAX_HEAD.  Such built additionally contains the revert of the single page frag cache so that napi_get_frags() ends up using the page frag allocator, triggering the splat.  Note that the underlying issue is independent from the mentioned revert; address it ensuring that the small head cache will fit either TCP and GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb() to select kmalloc() usage for any allocation fitting such cache.
published:2025-03-27T14:15:47.873


Instruction: Please provide detailed information about CVE-2025-21869


Instruction: Please provide detailed information about CVE-2025-21870

CVE:CVE-2025-21870
Description:In the Linux kernel, the following vulnerability has been resolved:  ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers  Other, non DAI copier widgets could have the same  stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data is attached, which could lead to NULL pointer dereference. We could check for this NULL pointer in sof_ipc4_prepare_copier_module() and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai() will miscalculate the ALH device count, causing broken audio.  The correct fix is to harden the matching logic by making sure that the 1. widget is a DAI widget - so dai = w->private is valid 2. the dai (and thus the copier) is ALH copier
published:2025-03-27T14:15:48.543


Instruction: Please provide detailed information about CVE-2025-21871

CVE:CVE-2025-21871
Description:In the Linux kernel, the following vulnerability has been resolved:  tee: optee: Fix supplicant wait loop  OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes more complicated when there is incorrect shutdown ordering of the supplicant process vs the OP-TEE client application which can eventually lead to system hang-up waiting for the closure of the client application.  Allow the client process waiting in kernel for supplicant response to be killed rather than indefinitely waiting in an unkillable state. Also, a normal uninterruptible wait should not have resulted in the hung-task watchdog getting triggered, but the endless loop would.  This fixes issues observed during system reboot/shutdown when supplicant got hung for some reason or gets crashed/killed which lead to client getting hung in an unkillable state. It in turn lead to system being in hung up state requiring hard power off/on to recover.
published:2025-03-27T14:15:48.860


Instruction: Please provide detailed information about CVE-2025-22672

CVE:CVE-2025-22672
Description:Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through 1.1.2.
published:2025-03-27T14:15:49.080


Instruction: Please provide detailed information about CVE-2025-22673

CVE:CVE-2025-22673
Description:Missing Authorization vulnerability in WPFactory EAN for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EAN for WooCommerce: from n/a through 5.3.5.
published:2025-03-27T14:15:49.250


Instruction: Please provide detailed information about CVE-2025-22770

CVE:CVE-2025-22770
Description:Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6.
published:2025-03-27T14:15:49.417


Instruction: Please provide detailed information about CVE-2025-22816

CVE:CVE-2025-22816
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeTrendy Power Mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through 1.1.5.
published:2025-03-27T14:15:49.570


Instruction: Please provide detailed information about CVE-2025-25086

CVE:CVE-2025-25086
Description:Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta allows Reflected XSS.This issue affects Secret Meta: from n/a through 1.2.1.
published:2025-03-27T14:15:49.737


Instruction: Please provide detailed information about CVE-2025-25100

CVE:CVE-2025-25100
Description:Cross-Site Request Forgery (CSRF) vulnerability in victoracano Cazamba allows Reflected XSS.This issue affects Cazamba: from n/a through 1.2.
published:2025-03-27T14:15:50.743


Instruction: Please provide detailed information about CVE-2025-26619

CVE:CVE-2025-26619
Description:Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. The issue is patched in `vega` `5.31.0`  and `vega-functions` `5.16.0`. Some workarounds are available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
published:2025-03-27T14:15:52.987


Instruction: Please provide detailed information about CVE-2025-26731

CVE:CVE-2025-26731
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARPrice allows Stored XSS.This issue affects ARPrice: from n/a through 4.1.3.
published:2025-03-27T14:15:53.140


Instruction: Please provide detailed information about CVE-2025-26732

CVE:CVE-2025-26732
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BurgerThemes StoreBiz allows DOM-Based XSS.This issue affects StoreBiz: from n/a through 1.0.32.
published:2025-03-27T14:15:53.293


Instruction: Please provide detailed information about CVE-2025-26734

CVE:CVE-2025-26734
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peregrinethemes Hester allows Stored XSS.This issue affects Hester: from n/a through 1.1.10.
published:2025-03-27T14:15:53.443


Instruction: Please provide detailed information about CVE-2025-26736

CVE:CVE-2025-26736
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viktoras MorningTime Lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through 1.3.2.
published:2025-03-27T14:15:53.593


Instruction: Please provide detailed information about CVE-2025-26737

CVE:CVE-2025-26737
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes City Store allows DOM-Based XSS.This issue affects City Store: from n/a through 1.4.5.
published:2025-03-27T14:15:53.740


Instruction: Please provide detailed information about CVE-2025-26738

CVE:CVE-2025-26738
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through 3.1.3.
published:2025-03-27T14:15:53.903


Instruction: Please provide detailed information about CVE-2025-27793

CVE:CVE-2025-27793
Description:Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.
published:2025-03-27T14:15:54.060


Instruction: Please provide detailed information about CVE-2025-2849

CVE:CVE-2025-2849
Description:A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.
published:2025-03-27T14:15:55.303


Instruction: Please provide detailed information about CVE-2025-2852

CVE:CVE-2025-2852
Description:A vulnerability has been found in SourceCodester Food Ordering Management System up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menus/view_menu.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-27T14:15:55.527


Instruction: Please provide detailed information about CVE-2025-2857

CVE:CVE-2025-2857
Description:Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being exploited in the wild.  *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
published:2025-03-27T14:15:55.720


Instruction: Please provide detailed information about CVE-2025-2867

CVE:CVE-2025-2867
Description:An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.
published:2025-03-27T14:15:55.827


Instruction: Please provide detailed information about CVE-2025-1997

CVE:CVE-2025-1997
Description:IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
published:2025-03-27T15:15:54.550


Instruction: Please provide detailed information about CVE-2025-1998

CVE:CVE-2025-1998
Description:IBM UrbanCode Deploy (UCD) through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1   stores potentially sensitive authentication token information in log files that could be read by a local user.
published:2025-03-27T15:15:54.707


Instruction: Please provide detailed information about CVE-2025-21872

CVE:CVE-2025-21872
Description:In the Linux kernel, the following vulnerability has been resolved:  efi: Don't map the entire mokvar table to determine its size  Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback:    ------------[ cut here ]------------   WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220   ...   Call Trace:    <TASK>    ? __early_ioremap+0xef/0x220    ? __warn.cold+0x93/0xfa    ? __early_ioremap+0xef/0x220    ? report_bug+0xff/0x140    ? early_fixup_exception+0x5d/0xb0    ? early_idt_handler_common+0x2f/0x3a    ? __early_ioremap+0xef/0x220    ? efi_mokvar_table_init+0xce/0x1d0    ? setup_arch+0x864/0xc10    ? start_kernel+0x6b/0xa10    ? x86_64_start_reservations+0x24/0x30    ? x86_64_start_kernel+0xed/0xf0    ? common_startup_64+0x13e/0x141    </TASK>   ---[ end trace 0000000000000000 ]---   mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187.  Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once.  Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size.  Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place.
published:2025-03-27T15:15:54.973


Instruction: Please provide detailed information about CVE-2025-21873

CVE:CVE-2025-21873
Description:In the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: bsg: Fix crash when arpmb command fails  If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn().  In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len.  Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22  4,1308,531166555,-;Call Trace:  4,1309,531166559,-; <TASK>  4,1310,531166565,-; ? show_regs+0x6d/0x80  4,1311,531166575,-; ? die+0x37/0xa0  4,1312,531166583,-; ? do_trap+0xd4/0xf0  4,1313,531166593,-; ? do_error_trap+0x71/0xb0  4,1314,531166601,-; ? usercopy_abort+0x6c/0x80  4,1315,531166610,-; ? exc_invalid_op+0x52/0x80  4,1316,531166622,-; ? usercopy_abort+0x6c/0x80  4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20  4,1318,531166643,-; ? usercopy_abort+0x6c/0x80  4,1319,531166652,-; __check_heap_object+0xe3/0x120  4,1320,531166661,-; check_heap_object+0x185/0x1d0  4,1321,531166670,-; __check_object_size.part.0+0x72/0x150  4,1322,531166679,-; __check_object_size+0x23/0x30  4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0
published:2025-03-27T15:15:55.093


Instruction: Please provide detailed information about CVE-2025-21874

CVE:CVE-2025-21874
Description:In the Linux kernel, the following vulnerability has been resolved:  dm-integrity: Avoid divide by zero in table status in Inline mode  In Inline mode, the journal is unused, and journal_sectors is zero.  Calculating the journal watermark requires dividing by journal_sectors, which should be done only if the journal is configured.  Otherwise, a simple table query (dmsetup table) can cause OOPS.  This bug did not show on some systems, perhaps only due to compiler optimization.  On my 32-bit testing machine, this reliably crashes with the following:   : Oops: divide error: 0000 [#1] PREEMPT SMP  : CPU: 0 UID: 0 PID: 2450 Comm: dmsetup Not tainted 6.14.0-rc2+ #959  : EIP: dm_integrity_status+0x2f8/0xab0 [dm_integrity]  ...
published:2025-03-27T15:15:55.203


Instruction: Please provide detailed information about CVE-2025-21875

CVE:CVE-2025-21875
Description:In the Linux kernel, the following vulnerability has been resolved:  mptcp: always handle address removal under msk socket lock  Syzkaller reported a lockdep splat in the PM control path:    WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 sock_owned_by_me include/net/sock.h:1711 [inline]   WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 msk_owned_by_me net/mptcp/protocol.h:363 [inline]   WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 mptcp_pm_nl_addr_send_ack+0x57c/0x610 net/mptcp/pm_netlink.c:788   Modules linked in:   CPU: 0 UID: 0 PID: 6693 Comm: syz.0.205 Not tainted 6.14.0-rc2-syzkaller-00303-gad1b832bf1cf #0   Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024   RIP: 0010:sock_owned_by_me include/net/sock.h:1711 [inline]   RIP: 0010:msk_owned_by_me net/mptcp/protocol.h:363 [inline]   RIP: 0010:mptcp_pm_nl_addr_send_ack+0x57c/0x610 net/mptcp/pm_netlink.c:788   Code: 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ca 7b d3 f5 eb b9 e8 c3 7b d3 f5 90 0f 0b 90 e9 dd fb ff ff e8 b5 7b d3 f5 90 <0f> 0b 90 e9 3e fb ff ff 44 89 f1 80 e1 07 38 c1 0f 8c eb fb ff ff   RSP: 0000:ffffc900034f6f60 EFLAGS: 00010283   RAX: ffffffff8bee3c2b RBX: 0000000000000001 RCX: 0000000000080000   RDX: ffffc90004d42000 RSI: 000000000000a407 RDI: 000000000000a408   RBP: ffffc900034f7030 R08: ffffffff8bee37f6 R09: 0100000000000000   R10: dffffc0000000000 R11: ffffed100bcc62e4 R12: ffff88805e6316e0   R13: ffff88805e630c00 R14: dffffc0000000000 R15: ffff88805e630c00   FS:  00007f7e9a7e96c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 0000001b2fd18ff8 CR3: 0000000032c24000 CR4: 00000000003526f0   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400   Call Trace:    <TASK>    mptcp_pm_remove_addr+0x103/0x1d0 net/mptcp/pm.c:59    mptcp_pm_remove_anno_addr+0x1f4/0x2f0 net/mptcp/pm_netlink.c:1486    mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_netlink.c:1518 [inline]    mptcp_pm_nl_del_addr_doit+0x118d/0x1af0 net/mptcp/pm_netlink.c:1629    genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]    genl_rcv_msg+0xb1f/0xec0 net/netlink/genetlink.c:1210    netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2543    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219    netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]    netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1348    netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1892    sock_sendmsg_nosec net/socket.c:718 [inline]    __sock_sendmsg+0x221/0x270 net/socket.c:733    ____sys_sendmsg+0x53a/0x860 net/socket.c:2573    ___sys_sendmsg net/socket.c:2627 [inline]    __sys_sendmsg+0x269/0x350 net/socket.c:2659    do_syscall_x64 arch/x86/entry/common.c:52 [inline]    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83    entry_SYSCALL_64_after_hwframe+0x77/0x7f   RIP: 0033:0x7f7e9998cde9   Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48   RSP: 002b:00007f7e9a7e9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e   RAX: ffffffffffffffda RBX: 00007f7e99ba5fa0 RCX: 00007f7e9998cde9   RDX: 000000002000c094 RSI: 0000400000000000 RDI: 0000000000000007   RBP: 00007f7e99a0e2a0 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000   R13: 0000000000000000 R14: 00007f7e99ba5fa0 R15: 00007fff49231088  Indeed the PM can try to send a RM_ADDR over a msk without acquiring first the msk socket lock.  The bugged code-path comes from an early optimization: when there are no subflows, the PM should (usually) not send RM_ADDR notifications.  The above statement is incorrect, as without locks another process could concur ---truncated---
published:2025-03-27T15:15:55.307


Instruction: Please provide detailed information about CVE-2025-21876

CVE:CVE-2025-21876
Description:In the Linux kernel, the following vulnerability has been resolved:  iommu/vt-d: Fix suspicious RCU usage  Commit <d74169ceb0d2> ("iommu/vt-d: Allocate DMAR fault interrupts locally") moved the call to enable_drhd_fault_handling() to a code path that does not hold any lock while traversing the drhd list. Fix it by ensuring the dmar_global_lock lock is held when traversing the drhd list.  Without this fix, the following warning is triggered:  =============================  WARNING: suspicious RCU usage  6.14.0-rc3 #55 Not tainted  -----------------------------  drivers/iommu/intel/dmar.c:2046 RCU-list traversed in non-reader section!!                other info that might help us debug this:                rcu_scheduler_active = 1, debug_locks = 1  2 locks held by cpuhp/1/23:  #0: ffffffff84a67c50 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x87/0x2c0  #1: ffffffff84a6a380 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x87/0x2c0  stack backtrace:  CPU: 1 UID: 0 PID: 23 Comm: cpuhp/1 Not tainted 6.14.0-rc3 #55  Call Trace:   <TASK>   dump_stack_lvl+0xb7/0xd0   lockdep_rcu_suspicious+0x159/0x1f0   ? __pfx_enable_drhd_fault_handling+0x10/0x10   enable_drhd_fault_handling+0x151/0x180   cpuhp_invoke_callback+0x1df/0x990   cpuhp_thread_fun+0x1ea/0x2c0   smpboot_thread_fn+0x1f5/0x2e0   ? __pfx_smpboot_thread_fn+0x10/0x10   kthread+0x12a/0x2d0   ? __pfx_kthread+0x10/0x10   ret_from_fork+0x4a/0x60   ? __pfx_kthread+0x10/0x10   ret_from_fork_asm+0x1a/0x30   </TASK>  Holding the lock in enable_drhd_fault_handling() triggers a lockdep splat about a possible deadlock between dmar_global_lock and cpu_hotplug_lock. This is avoided by not holding dmar_global_lock when calling iommu_device_register(), which initiates the device probe process.
published:2025-03-27T15:15:55.430