CVE-2025-54074

CVE-2025-54074 affects Cherry Studio desktop client, versions 1.2.5–1.5.1, which are vulnerable to OS command injection when connecting to a malicious MCP server over HTTP Streamable mode. The underlying issue arises during the OAuth-enabled connection process, allowing an attacker-controlled MCP...

PT-2025-32989 · Unknown · Cherry-Studio

Name of the Vulnerable Software and Affected Versions: Cherry Studio versions 1.2.5 through 1.5.1 Description: Cherry Studio is vulnerable to OS Command Injection when connecting to a malicious MCP server in HTTP Streamable mode. Attackers can establish a malicious MCP server with compatible OAut...

CVE-2025-50692

FoxCMS =v1.2.5 is vulnerable to Code Execution in admin/templatefile/editFile.html...

FoxCMS 安全漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS 1.2.5 and earlier versions, which originates from a code execution vulnerability in admin/templatefile/editFile.html...

CVE-2025-50692

FoxCMS =v1.2.5 is vulnerable to Code Execution in admin/templatefile/editFile.html...

OPENSUSE-SU-2025:15370-1 hauler-1.2.5-1.1 on GA media

These are all security issues fixed in the hauler-1.2.5-1.1 package on the GA media of openSUSE Tumbleweed...

WordPress plugin Chatbox Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

FoxCMS 注入漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.2.5 and previous versions exist injection vulnerability, the vulnerability stems from the file app/admin/controller/Video.php in the parameter ids of the wrong operation leads to SQL injection...

CVE-2024-43334 WordPress Zilom theme < 1.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affects Zilom: from n/a through 1.4.5...

FoxCMS 注入漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.2.5 and previous versions exist injection vulnerability, the vulnerability stems from the file app/admin/controller/Download.php in the parameter ids of the wrong operation leads to SQL injection...

CVE-2025-5155

A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/admin/controller/Article.php. The manipulation of the argument ids leads to sql injection. The attack can be launched remotely. The exploit h...

CVE-2025-46456

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Sliders theme-blvd-sliders allows Reflected XSS.This issue affects Theme Blvd Sliders: from n/a through = 1.2.5...

PT-2025-22867 · Qianfox · Foxcms

Name of the Vulnerable Software and Affected Versions: qianfox FoxCMS version 1.2.5 Description: A critical issue has been found in the batchCope function of the app/admin/controller/Article.php file. The manipulation of the ids argument leads to SQL injection. This issue can be exploited remotel...

FoxCMS 注入漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. An injection vulnerability exists in FoxCMS version 1.2.5, which is caused by incorrect manipulation of the parameter ids in the file app/admin/controller/Article.php resulting in SQL injection...

CVE-2025-5058

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setimage function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-4603

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2025-4602

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the getfile function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2025-4336

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-46456 WordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Sliders allows Reflected XSS. This issue affects Theme Blvd Sliders: from n/a through 1.2.5...

CVE-2025-22302

Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through = 1.2.5...