CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...

CVE-2025-55748

Affected product : XWiki Platform. Vulnerability : path traversal through the jsx and sx endpoints that allows remote attackers to read configuration files. Root cause : improper access control enabling traversal to read files like WEB-INF/xwiki.cfg. Versions affected : 4.2-milestone-2 through 16...

Linux Distros Unpatched Vulnerability : CVE-2019-20924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the...

CVE-2025-57833

CVE-2025-57833 affects Django 4.2 (pre-4.2.24), 5.1 (pre-5.1.12), and 5.2 (pre-5.2.6). The vulnerability arises in FilteredRelation where SQL injection can occur via column aliases when a crafted dictionary is expanded through **kwargs passed to QuerySet.annotate() or QuerySet.alias(). The issue ...

Linux Distros Unpatched Vulnerability : CVE-2021-20330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential...

Linux Distros Unpatched Vulnerability : CVE-2023-35133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3,...

Linux Distros Unpatched Vulnerability : CVE-2020-21688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code. CVE-2020-21688 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2020-21697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

Linux Distros Unpatched Vulnerability : CVE-2020-22032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vfedgedetect.c in gaussianblur, which might lead to memory corruption and other...

Linux Distros Unpatched Vulnerability : CVE-2020-22028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability exists in FFmpeg 4.2 in filtervertically8 at libavfilter/vfavgblur.c, which could cause a remote Denial of Service. CVE-2020-22028...

Linux Distros Unpatched Vulnerability : CVE-2025-32022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts o...

Linux Distros Unpatched Vulnerability : CVE-2014-4986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple cross-site scripting XSS vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow...

Linux Distros Unpatched Vulnerability : CVE-2025-48432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which...

CVE-2025-9094

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2025-9094 ThingsBoard Add Gateway special elements used in a template engine

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...

PT-2025-33619

Name of the Vulnerable Software and Affected Versions: ThingsBoard version 4.1 Description: A vulnerability exists in ThingsBoard that affects unknown code within the Add Gateway Handler component. The issue involves improper neutralization of special elements used in a template engine, allowing...

CVE-2025-38745

Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2025-38745

Dell OpenManage Enterprise (versions 3.10, 4.0, 4.1, 4.2) contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore functionality. A low-privileged attacker with remote access could potentially exploit this to cause Information exposure. Connected source...

CVE-2025-54690

CVE-2025-54690 is a WordPress/Xinterio Theme

PT-2025-33242 · Themestek · Xinterio

Name of the Vulnerable Software and Affected Versions: Xinterio versions through 4.2 Description: An Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability exists in themeStek Xinterio, allowing PHP Local File Inclusion. Recommendations...