Passport-wsfed-saml2 安全漏洞

Passport-wsfed-saml2 is an Auth0 open source token authentication provider program. A security vulnerability exists in Passport-wsfed-saml2 versions 3.0.5 through 4.6.3, which stems from SAML response tampering and could lead to user impersonation...

Hoteldruid 安全漏洞

Hoteldruid is a free and open source hotel management program from Hoteldruid. A security vulnerability exists in Hoteldruid version v3.0.5, which stems from the injection of a specially crafted payload in the commento11 parameter, which could lead to a cross-site scripting attack...

PT-2025-17561 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1 1 parameter. This enables attackers to potentially manipulate w...

CVE-2025-32504 WordPress Silvasoft boekhouden plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in silvasoft Silvasoft boekhouden silvasoft-boekhouden allows Reflected XSS.This issue affects Silvasoft boekhouden: from n/a through = 3.0.6...

WordPress plugin Silvasoft boekhouden 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

http-proxy-middleware 安全漏洞

http-proxy-middleware is a Node.js http proxy middleware for connect, express, next.js, etc. by Steven Chim Personal Developer. A security vulnerability exists in http-proxy-middleware versions prior to 2.0.9 and prior to 3.0.5, which stems from the bodyParser failing and continuing to process...

WordPress Verowa Connect Plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Verowa Connect versions = 3.0.4...

WordPress plugin Verowa Connect SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress plugin Simple Banner 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5608

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 1.6.1 Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.5 Description The issue is related to arbitrary remote code execution when accessing a malicious website while the Vitest API server is listening, due t...

WordPress VForm plugin <= 3.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin VPSUForm versions = 3.0.5...

PT-2025-5440 · Vform · Vform

Name of the Vulnerable Software and Affected Versions: VForm versions through 3.0.5 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through 3.0.5, update to a...

CVE-2024-13284 Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

Cross-Site Request Forgery CSRF vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5...

CVE-2024-11662 welliamcao OpsManage API Endpoint deploy_api.py deploy_host_vars deserialization

A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deployhostvars of the file /apps/api/views/deployapi.py of the component API Endpoint. The manipulation leads to deserialization. The attack may be...

CVE-2024-11662

CVE-2024-11662 affects welliamcao OpsManage, specifically the deploy_host_vars function in /apps/api/views/deploy_api.py of the API Endpoint. A deserialization vulnerability exists in versions 3.0.1–3.0.5 that can be exploited remotely; exploitation details have been publicly disclosed. Connected...

PT-2024-17172 · Welliamcao · Ops Manager

Name of the Vulnerable Software and Affected Versions: welliamcao OpsManage versions 3.0.1 through 3.0.5 Description: A critical issue affects the deploy host vars function of the /apps/api/views/deploy api.py file in the API Endpoint component. This issue leads to deserialization and can be...

Fedora 37 : openssl (2022-1c20b4dde2)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-1c20b4dde2 advisory. Automatic update for openssl-3.0.5-1.fc37. Changelog Tue Jul 5 2022 Clemens Lang - 1:3.0.5-1 - Rebase to upstream version 3.0.5 Related: rhbz2099972...

CVE-2024-51739

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...

CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...

CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...