GHSA-GCQF-PXGG-GW8Q Dpanel has an arbitrary file read vulnerability

Summary Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files. Details When a user logs into the administrative backend, this interface can read any files on the host/sever given the...

CVE-2025-53363

Summary: Dpanel (Go) versions 1.2.0–1.7.2 are affected by an arbitrary file read vulnerability in /api/app/compose/get-from-uri. The GetFromUri function passes the user-provided uri directly to os.ReadFile, enabling an authenticated user to read arbitrary files on the host and disclose sensitive ...

CVE-2025-53208

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

PT-2025-34374 · Dpanel · Dpanel

Name of the Vulnerable Software and Affected Versions: dpanel versions 1.2.0 through 1.7.2 Description: dpanel is a server management panel written in Go. Versions of the software allow authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to empty request bodies not being properly rejected. An attacker can cause users to perform unintended actions by tricking them into clicking malicious links through post actions. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper validating access controls at time of access. An attacker can gain unauthorized access to thread content by leveraging AI-generated posts. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper validating access controls at time of access. An attacker can gain unauthorized access to thread content by leveraging AI-generated posts. Remediation Upgrade...

PT-2025-34306 · Ftppad · Ftppad

Name of the Vulnerable Software and Affected Versions: FTPPad versions prior to 1.3.0 Description: FTPPad contains a stack-based buffer overflow in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessive...

Malicious code in @navify-platform/error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5b9e6a4a6b1cd28b115da5f53a42db16b7446f89c67032f0e75b747da1b3ef5c The OpenSSF Package Analysis project identified '@navify-platform/error' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-41253 Malicious code in @navify-platform/error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5b9e6a4a6b1cd28b115da5f53a42db16b7446f89c67032f0e75b747da1b3ef5c The OpenSSF Package Analysis project identified '@navify-platform/error' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

Malicious code in @navify-platform/i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 306d60012db44c48b4e577372019b8171e2eb15c6cfb80a9c1e5eb7df32149de The OpenSSF Package Analysis project identified '@navify-platform/i18n' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

CVE-2025-53208

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

CVE-2025-53208 WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

CVE-2025-53208

CVE-2025-53208 is a WordPress Maya Business plugin vulnerability affecting versions up to 1.2.0. The connected Red Hat and CVE records describe an authorization bypass through a user-controlled key, enabling an attacker to access functionality not properly constrained by ACLs (Insecure Direct Obj...

CVE-2025-53208 WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

Linux Distros Unpatched Vulnerability : CVE-2017-5929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. CVE-2017-5929 Note that Nessus...

PT-2025-33654 · Ibm · Ibm Concert

Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.1.0 Description: IBM Concert Software is susceptible to a cross-origin resource sharing CORS issue. This configuration allows an attacker to potentially perform privileged actions because the doma...

CVE-2025-54694

Cross-Site Request Forgery CSRF vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through = 1.2.0...

CVE-2025-54694

Cross-Site Request Forgery CSRF vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through = 1.2.0...

CVE-2025-54694

CVE-2025-54694 describes a Cross-Site Request Forgery in the WordPress plugin Button Block, affecting versions up to 1.2.0. The issue is confirmed in multiple sources and the CVE record shows a patch that updates beyond 1.2.0. Base metrics: CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N wit...