CVE-2025-26611

CVE-2025-26611 affects WeGIA, an open-source Web Manager for institutions. The vulnerability is a SQL Injection in the remover_produto.php endpoint (likely via the id_produto parameter), enabling arbitrary SQL queries and potential unauthorized access to sensitive data. The issue has been fixed i...

CVE-2025-26612 SQL Injection endpoint 'adicionar_almoxarife.php' parameter 'id_almoxarifado', 'id_funcionario' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, adicionaralmoxarife.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthoriz...

PT-2025-7211 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, adicionar almoxarife.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing...

WordPress Restrict Content plugin <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Restrict Content versions = 3.2.13...

CVE-2024-11090

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have bee...

PT-2024-37315 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder plugin for WordPress versions prior to 3.2.13 Description: The issue allows authenticated attackers with Subscriber-level access and above to create arbitrary posts and append arbitrary content to existing posts due to...

WordPress Cost Calculator Builder Plugin <= 3.2.12 is vulnerable to Cross Site Scripting (XSS)

Software Cost Calculator Builder Type Plugin Vulnerable versions = 3.2.12 Fixed in 3.2.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6011 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 19a4b52def1d Credits Guido Iván...

PT-2024-18410 · WordPress · Masterstudy Lms

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS plugin for WordPress versions up to, and including, 3.2.13 Description: The issue allows unauthorized access to data due to a missing capability check on the search posts function. This makes it possible for authenticated...

WordPress Plugin MasterStudy LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-16768 · WordPress · Wp-Optimize +1

Name of the Vulnerable Software and Affected Versions: WP-Optimize WordPress plugin versions prior to 3.2.13 SrbTransLatin WordPress plugin versions prior to 2.4.1 Description: The issue arises from the use of a third-party library that removes escaping on some HTML characters, leading to a...

WordPress plugin WP-Optimize 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

SUSE CVE-2013-4123

clientsiderequest.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header...

Django SQL Injection Vulnerability (CNVD-2022-31837)

Django is the Django Foundation's set of open source web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, etc. Django version 2.2.28 before version 2.2, version 3.2.13 before version 3.2, and version 4.0.4 before...

CVE-2022-28346

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate, aggregate, and extra methods are subject to SQL injection in column aliases via a crafted dictionary with dictionary expansion as the passed kwargs...

CVE-2022-28347

A SQL injection issue was discovered in QuerySet.explain in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary with dictionary expansion as the options argument, and placing the injection payload in an option name...

Security update for calamares (moderate)

openSUSE Security Update: Security update for calamares Announcement ID: openSUSE-SU-2019:2655-1 Rating: moderate References: 1140256 1152377 Cross-References: CVE-2019-13178 Affected Products: openSUSE Backports SLE-15-SP1 An update that solves one vulnerability and has one errata is now...

openSUSE: Security Advisory for calamares (openSUSE-SU-2019:2628-1)

The remote host is missing an update for the calamares packages announced via the openSUSE-SU-2019:2628-1 advisory. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

DEBIAN-CVE-2019-10192

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write ...

ALPINE-CVE-2019-10192

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write ...

FFmpeg < 3.2.14 Use Of Uninitialized Variables

FFmpeg does not check for sscanf failure and consequently allows use of uninitialized variables. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...