CVE-2025-3680: Buffer Copy without Checking Size of Input

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component LANG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to...

Integer Overflow

cairo-lang-starknet-classes is vulnerable to Integer overflow. The vulnerability is due to improper bounds checking in the Sierra bytecode decompression logic of the cairo-lang-starknet-classes library, allows an integer overflow to occur when processing malicious Declare v2/v3 transactions...

SUSE CVE-2025-29072

An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop and high CPU usage by submitting a malicious Declare v2/v3 transaction. This results in a...

CVE-2025-29072: Integer Overflow or Wraparound

An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop and high CPU usage by submitting a malicious Declare v2/v3 transaction. This results in a...

CVE-2025-29072

An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop and high CPU usage by submitting a malicious Declare v2/v3 transaction. This results in a...

Malware in elm-lang-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-2668 Malicious code in elm-lang-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d5eb3c2ea771ad8d786241ffd33fd3345d71c3a00d5aa6a053d81034de8ebd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in elm-lang-http

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

The vulnerability of the setLanguageCfg() function in TOTOLINK EX200 router microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the setLanguageCfg function in TOTOLINK EX200 router microprogramming software lies in the lack of measures taken to clean up data at the control level when processing the langType parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-12016

Name of the Vulnerable Software and Affected Versions: Age Gate plugin for WordPress versions up to, and including, 3.5.3 Description: The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion via the lang parameter. This allows unauthenticated attackers to include and execute...

CVE-2025-2505: Improper Limitation of a Pathname to a Restricted Directory

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those...

WordPress Age Gate plugin <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang' vulnerability

Unauthenticated Local PHP File Inclusion via 'lang' vulnerability discovered by mikemyers in WordPress Plugin Age Gate versions = 3.5.3...

VulnCheck KEV: CVE-2025-2505

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those...

Malicious code in pkl-lang.org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e62ea2ef542d2e8dda998bfe58ca7673af23732af531365aeb706076f9ea9fd9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-17376 · WordPress · Quran Multilanguage Text & Audio

Name of the Vulnerable Software and Affected Versions: The Quran multilanguage Text & Audio plugin for WordPress versions prior to 2.3.22 Description: The issue is related to Reflected Cross-Site Scripting via the sourate and lang parameters due to insufficient input sanitization and output...

CVE-2024-11973: Improper Neutralization of Input During Web Page Generation

The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress plugin Quran multilanguage Text & Audio 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the WordPress plugi...

PT-2024-16699 · WordPress · Fileorganizer

Name of the Vulnerable Software and Affected Versions: FileOrganizer – Manage WordPress and Website Files plugin for WordPress versions up to, and including, 1.1.4 Description: The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary file...

apache-commons-lang:LocaleUtilsFuzzer: Security exception in java.base/java.lang.String.encodeWithEncoder

Detailed Report: https://oss-fuzz.com/testcase?key=6072512272728064 Project: apache-commons-lang Fuzzing Engine: libFuzzer Fuzz Target: LocaleUtilsFuzzer Job Type: libfuzzerasanapache-commons-lang Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

GHSA-78P3-FWCQ-62C2 @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings

Summary The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of the cfgStrings object. It allows to add/modify properties of the Object prototype that result in severa...