TencentOS Server 4: nodejs (TSSA-2025:0645)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0645 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SQL Injection

Overview lee-to/moonshine-tree-resource is a Tree resource for moonshine Affected versions of this package are vulnerable to SQL Injection via the data parameter in the Route::moonshine function. An attacker can exploit this to read sensitive data from the database. Remediation Upgrade...

CVE-2025-51510

MoonShine contains a SQL injection in the Blog module via the data parameter of the moonshine-tree-resource component (versions Categories page. Root cause: unsafely embedded data parameter allows injection; PoCs and public reports describe extracting data from moonshine_users and demonstrating ...

CVE-2025-51510

MoonShine was discovered to contain a SQL injection vulnerability under the Blog - Categories page when using the moonshine-tree-resource version 2.0.2 component...

CVE-2025-51510

MoonShine was discovered to contain a SQL injection vulnerability under the Blog - Categories page when using the moonshine-tree-resource version 2.0.2 component...

Linux Distros Unpatched Vulnerability : CVE-2022-30321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and...

Linux Distros Unpatched Vulnerability : CVE-2022-30322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0...

CVE-2025-8491

The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsceprmsavemenu function. This makes it possible for unauthenticated attackers to upload a men...

CVE-2025-8491

CVE-2025-8491 concerns the Easy restaurant menu manager plugin for WordPress. The vulnerability is a Cross-Site Forgery (CSRF) due to missing/incorrect nonce validation in the nsc_eprm_save_menu() function, allowing unauthenticated attackers to upload a menu file by tricking an administrator. Aff...

WordPress Easy restaurant menu manager plugin <= 2.0.2 - Cross-Site Request Forgery to Menu Upload vulnerability

Cross-Site Request Forgery to Menu Upload vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Easy pdf restaurant menu upload versions = 2.0.2...

CVE-2025-54780

The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2...

Linux Distros Unpatched Vulnerability : CVE-2025-7962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

CVE-2025-54780

The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2...

CVE-2025-54780 glpi-screenshot-plugin exposes local files in /ajax/screenshot.php

The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2...

CVE-2025-54780 glpi-screenshot-plugin exposes local files in /ajax/screenshot.php

The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2...

glpi-inventory-plugin 安全漏洞

glpi-inventory-plugin is a GLPI open source GLPI inventory plugin. A security vulnerability exists in glpi-inventory-plugin versions prior to 2.0.2, which stems from a file disclosure vulnerability in the /ajax/screenshot.php endpoint...

PT-2025-31884 · Glpi · Glpi-Screenshot-Plugin

Name of the Vulnerable Software and Affected Versions: glpi-screenshot-plugin versions prior to 2.0.2 Description: The glpi-screenshot-plugin allows users to take screenshots or screen recordings directly from GLPI. Authenticated users can use the /ajax/screenshot.php endpoint to leak files from...

cosmwasm-std crate 输入验证错误漏洞

cosmwasm-std crate is a CosmWasm open source framework for building smart contracts in Wasm for the Cosmos SDK. An input validation error vulnerability exists in cosmwasm-std crate versions prior to 2.0.2, which stems from an integer overflow that could lead to a computation error...

SUSE CVE-2025-7338

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service DoS by sending a malformed multi-part upload request. This request causes an unhandled...

GHSA-FJGF-RC76-4X9P Multer vulnerable to Denial of Service via unhandled exception from malformed request

Impact A vulnerability in Multer versions = 1.4.4-lts.1, 2.0.2 allows an attacker to trigger a Denial of Service DoS by sending a malformed request. This request causes an unhandled exception, leading to a crash of the process. Patches Users should upgrade to 2.0.2 Workarounds None...