Archive
2 December 2025
Vulnerabilities first published on this day (UTC), newest first.
97 results · Clear filters · Feed
-
Medium 4.1
Donation <= 1.0 - Admin+ SQLi
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
-
Medium 6.5
Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19. This is due to missing or incorrect nonce validation on the `parseData` function. This makes i…
-
Medium 4.4
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local informa…
-
Medium 4.4
In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial o…
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation o…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 6.7
In display, there is a possible escalation of privilege due to improper input validation. This could lead to local esca…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 4.7
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if …
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE h…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 4.9
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 6.5
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of s…
-
Medium 5.3
In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.4
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute
The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘timestamp’ attribute in all versions up to, and including, 2.2.13 due t…
-
Medium 5.4
HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulne…
-
Medium 4.5
Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote att…
-
Medium 4.0
Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity…
-
Medium 4.0
Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary scri…
-
Medium 5.5
Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary scr…
-
Medium 4.0
Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access part…
-
Medium 5.9
Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows lo…
-
Medium 4.3
Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access …
-
Medium 4.3
Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-b…
-
Medium 4.3
Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-…
-
Medium 4.3
Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attacker…
-
Medium 4.2
Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-…
-
Medium 5.6
Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write o…