CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

PT-2025-39989

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The import coa function located at erpnext/accounts/doctype/chart of accounts importer/chart of accounts importer.py is susceptible to SQL injection. An attacker can inject a SQL query through the...

CVE-2025-52043

CVE-2025-52043 affects Frappe ERPNext v15.57.5, where the import_coa() function in ERPNext’s chart_of_accounts_importer.py is vulnerable to SQL injection via the company parameter. This allows an attacker to extract database data. Connected sources corroborate a SQL injection in the import_coa fu...

CVE-2025-40838

Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information...

PT-2025-39669

Name of the Vulnerable Software and Affected Versions Aranda PassRecovery version 1.0 Description An issue allows attackers to enumerate valid user accounts in Active Directory. This is achieved by sending a crafted POST request to the /user/existdirectory/1 API endpoint. The POST request allows...

CVE-2025-43993

creationtimestamp| type| source ---|---|--- 2025-09-25 19:51:44+00:00| seen| Telegram/b-QaMo27D801K5oUXBbHxi6vk99OhglIGgoZF-CrvDshJFA 2026-01-16 18:08:53+00:00| seen| Telegram/I3-zFtaxViYXm9hfGR-UWotuHKxXoIhOFZR3YKeNWqfhCxo...

CVE-2025-40838

Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information...

CVE-2025-41716

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...

PT-2025-39402

Name of the Vulnerable Software and Affected Versions Ericsson Indoor Connect 8855 affected versions not specified Description The Ericsson Indoor Connect 8855 has a security issue where client-side server-side security checks can be bypassed. Successful exploitation of this issue could result in...

CVE-2025-58704

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.4...

CVE-2025-41716 Unauthenticated User Enumeration via Missing Authentication

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...

WAGO Device Sphere和WAGO Solution Builder 访问控制错误漏洞

WAGO Device Sphere and WAGO Solution Builder are products of WAGO, a device management system, and WAGO Solution Builder, a project configuration and engineering platform. An Access Control Error vulnerability exists in WAGO Device Sphere and WAGO Solution Builder, which stems from a lack of...

WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin WP Delete User Accounts versions = 1.2.4...

CVE-2025-58704 WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.4...

CVE-2025-58704

CVE-2025-58704 affects the WordPress plugin “WP Delete User Accounts” (WP Delete User Accounts). The connected Wordfence vulnerability data indicates an in‑the‑wild style issue: Stored Cross‑Site Scripting (XSS) in input during web page generation, impacting plugin versions up to 1.2.4. The CVE d...

CVE-2025-58704 WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.4...

How to Gain Control of AI Agents and Non-Human Identities

We hear this a lot: "We've got hundreds of service accounts and AI agents running in the background. We didn't create most of them. We don't know who owns them. How are we supposed to secure them?" Every enterprise today runs on more than users. Behind the scenes, thousands of non-human identitie...

PT-2025-38982

Name of the Vulnerable Software and Affected Versions Ren Ventura WP Delete User Accounts versions through 1.2.4 Description The software contains a flaw related to improper handling of user-supplied data when creating web pages, which can lead to Stored Cross-Site Scripting XSS. This allows an...