CVE-2025-48947

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for...

CVE-2024-1076

The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who...

CVE-2024-12593

The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdfdotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-37826

A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2023-45753

Cross-Site Request Forgery CSRF vulnerability in Gilles Dumas which template file plugin = 4.6.0 versions...

CVE-2023-28498

Cross-Site Request Forgery CSRF vulnerability in MotoPress Hotel Booking Lite plugin = 4.6.0 versions...

CVE-2022-39351

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

CVE-2020-9388

CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard...

CVE-2020-9390

SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script...

CVE-2020-9389

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames...

CVE-2020-26138

In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation...

WordPress plugin Logo Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-24755

CVE-2025-24755 refers to a stored XSS in the WordPress plugin PDF Invoices for WooCommerce + Drag and Drop Template Builder (PDF Invoices for WooCommerce + Drag and Drop Template Builder) affecting versions up to 4.6.0. Connected sources assign the vulnerability to stored XSS due to improper inpu...

WordPress PDF Invoice Builder for WooCommerce plugin <= 4.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 4.6.0...

PT-2025-5426 · Unknown · Jsm Show Post Metadata

Name of the Vulnerable Software and Affected Versions: JSM Show Post Metadata versions through 4.6.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through...

Dell AppSync Server 安全漏洞

Dell AppSync Server is a copy data management software from Dell USA. A security vulnerability exists in Dell AppSync Server version 4.6.0.x, which stems from the inclusion of a symbolic link tracking vulnerability that could be exploited by a low-privileged attacker with local access rights to...

Out-of-bounds Write

Overview lightgbm is a gradient boosting framework that uses tree based learning algorithms. Affected versions of this package are vulnerable to Out-of-bounds Write in linkerssocket.cpp, used during initialization of distributed training. An attacker can exploit a race condition to connect to a...

RHSA-2018:1263 Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 release - RPMs

Bulletin has no description...

AZL-47759 CVE-2024-7006 affecting package libtiff for versions less than 4.6.0-3

A null pointer dereference flaw was found in Libtiff via tifdirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash,...

PT-2024-27062 · Unknown · Logging-Operator

Name of the Vulnerable Software and Affected Versions: logging-operator version 4.6.0 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For logging-operator version 4.6.0,...