1496 matches found
CVE-2023-53915 Zenphoto 1.6 Stored Cross-Site Scripting via Album Description
Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content into album descriptions. Attackers can create albums with malicious iframe or script tags in the description field that execute when users vi...
Zenphoto 跨站脚本漏洞
Zenphoto is a content management system from Zenphoto open source. A cross-site scripting vulnerability exists in Zenphoto version 1.6, which stems from improperly cleared user zip code fields and could lead to a stored cross-site scripting attack...
UK’s ICO Fine LastPass £1.2 Million Over 2022 Security Breach
UK's ICO fines LastPass £1.2M for the 2022 data breach that exposed 1.6 million users’ data. Learn how a flaw in an employee's personal PC led to the massive security failure...
DSA-6076-1 libpng1.6 - security update
Bulletin has no description...
ROOT-OS-DEBIAN-13-CVE-2025-66293 CVE-2025-66293 in rootio-libpng1.6 - Patched by Root
Root has patched CVE-2025-66293 in the rootio-libpng1.6 package for Root:Debian:13. Multiple fixed versions available...
Atlassian Jira Service Management Data Center and Server 5.10.0 < 5.12.26 / 10.0.x < 10.3.10 / 10.4.x < 10.7.3 / 11.0.x < 11.2.0 (JSDSERVER-16435)
The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16435 advisory. - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability i...
The Browser Company of New York Dia 安全漏洞
The Browser Company of New York Dia is an AI browser from The Browser Company of New York, USA. A security vulnerability exists in The Browser Company of New York Dia prior to version 1.6, which stems from a lack of notification alerts in full-screen mode and could lead to users being misled...
CVE-2025-11243 Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243 Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243
CVE-2025-11243 affects Shelly Pro 4PM prior to v1.6. Root cause is missing input bounds checking on multiple JSON-RPC endpoints, allowing an attacker to cause excessive memory allocation and trigger device reboots via the network. Impact is denial of service through repeated outages; evidence fro...
Shelly Pro 4PM 安全漏洞
Shelly Pro 4PM is an energy monitoring device from Shelly USA. A security vulnerability exists in Shelly Pro 4PM versions prior to 1.6, which stems from an unlimited resource allocation that could lead to over-allocation...
CVE-2025-12528
CVE-2025-12528 concerns the Pie Forms for WP WordPress plugin (versions <= 1.6). The issue is an Arbitrary File Upload due to insufficient file-type validation: validate_classic checks extensions but does not stop the upload, enabling unauthenticated attackers to upload dangerous extensions (e...
CVE-2025-12528 Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload
The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the formatclassic function. This is due to insufficient file type validation where the validateclassic method validates file extensions and sets error messages but does n...
WordPress Pie Forms for WP plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Vanh - GCSC in WordPress Plugin Drag & Drop Builder versions = 1.6...
PT-2025-46293
Name of the Vulnerable Software and Affected Versions Flickr Show plugin for WordPress versions prior to 1.6 Description The software is susceptible to Stored Cross-Site Scripting through the div height parameter of the 'flickrshow' shortcode. Insufficient input sanitization and output escaping...
CVE-2025-9403 affecting package jq for versions less than 1.6-5
CVE-2025-9403 affecting package jq for versions less than 1.6-5. A patched version of the package is available...
CVE-2025-63384
A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET Supervisor-mode Exception Return instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode M-mode to Supervisor-mode S-mode as specified by...
PT-2025-46191
Name of the Vulnerable Software and Affected Versions RISC-V Rocket-Chip versions 1.6 and earlier Description A flaw exists in the handling of the SRET Supervisor-mode Exception Return instruction within the processor. Instead of correctly transitioning from Machine-mode M-mode to Supervisor-mode...
EUVD-2025-37325
Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through = 1.6...
CVE-2025-64368
Summary: CVE-2025-64368 affects Mikado-Themes Bard Bardwp (WordPress Bard theme plugin). The vuln is a Cross-Site Request Forgery (CSRF) in Bardwp that allows an attacker to perform actions on behalf of authenticated users. Affected: Bard versions up to and including 1.6. Root cause: insufficient...