Croogo 安全漏洞

Croogo is Croogo open source a set of CakePHP framework based on the development of content management system CMS. The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. Croogo version 3.0.2 security vulnerabilities , the...

PT-2025-17297 · Croogo · Croogo

Name of the Vulnerable Software and Affected Versions: croogo version 3.0.2 Description: The issue allows an attacker to perform Host header injection via the feed.rss component. Recommendations: For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available...

CVE-2024-55211

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie...

Think Router Tk-Rt-Wr135G 安全漏洞

Think Router Tk-Rt-Wr135G is a router from Think. A security vulnerability exists in the Think Router Tk-Rt-Wr135G version V3.0.2-X000, which originates from an authentication bypass that can be accomplished with a specially crafted cookie...

PT-2025-17211 · Unknown · Think Router Tk-Rt-Wr135G

Name of the Vulnerable Software and Affected Versions: Think Router Tk-Rt-Wr135G version 3.0.2-X000 Description: The issue allows attackers to bypass authentication via a crafted cookie. Recommendations: For Think Router Tk-Rt-Wr135G version 3.0.2-X000, as a temporary workaround, consider...

CVE-2025-30893

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in varunvairavanlc LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through = 3.0.2...

CVE-2025-30893 WordPress LeadConnector plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through = 3.0.2...

CVE-2025-25122

Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through = 3.0.2...

CVE-2025-25122

Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through = 3.0.2...

CVE-2025-25122

CVE-2025-25122: NotFound WizShop WordPress plugin has an unauthenticated path traversal vulnerability that enables PHP local file inclusion in WizShop versions up to 3.0.2. The CVSS v3.1 base score is 8.1 (HIGH) with NETWORK attack vector, HIGH impact on confidentiality, integrity, and availabili...

WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Order Limit for WooCommerce versions = 3.0.2...

WordPress Post SMTP plugin <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Post SMTP versions = 3.0.2...

CVE-2023-48796

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

CVE-2023-49736

A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the...

CVE-2022-31764 Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

CVE-2022-31764 Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

CVE-2022-39214

Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1...

BIT-SUPERSET-2023-49736 Apache Superset: SQL Injection on where_in JINJA macro

A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the...

CVE-2024-31260

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.2...

CVE-2024-13259

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2...