Remote Code Execution

NagVis is vulnerable to Remote Code Execution RCE. The vulnerability is due to the ability of an authenticated administrator to upload a malicious PHP file and modify configuration settings, and attackers can exploit this to execute arbitrary PHP code on the server...

CVE-2024-13911 Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure

The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2024-13901 Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting

The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This...

WordPress Modal Portfolio plugin <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by WordFence in WordPress Plugin Modal Portfolio versions = 1.7.4.2...

CVE-2025-22210

A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands in the category management area in backend...

WordPress WP ULike plugin <= 4.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP ULike versions = 4.7.5...

WordPress Mambo Importer plugin <= 1.0 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Mambo Importer versions = 1.0...

CVE-2025-1239

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Firewa...

CVE-2025-1071

A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...

CVE-2025-1239

WatchGuard Fireware OS (WatchGuard Firebox) is affected by CVE-2025-1239. Affected versions are Fireware OS 12.0–12.5.12+701324 and 12.6–12.11. The issue is an improper neutralization of input during web page generation, enabling Stored XSS via the Blocked Sites list. An authenticated administrat...

CVE-2025-1071

The CVE-2025-1071 issue affects WatchGuard Fireware OS (Firebox) with the spamBlocker module, where improper input neutralization during web page generation enables Stored XSS. The vulnerability requires an authenticated administrator session to a locally managed Firebox and affects Fireware OS v...

PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig Plugin

A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the...

PT-2025-6775 · Palo Alto Networks · Pan-Os Openconfig Plugin

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS affected versions not specified Description: A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator to make gNMI requests to the PAN-OS management...

CVE-2022-1258

A blind SQL injection vulnerability in the ePolicy Orchestrator ePO extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server...

CVE-2022-40602

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00ABLG.6C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator...

CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance...

DEBIAN-CVE-2024-13723

The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP...

WordPress Connections Business Directory plugin <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion vulnerability

Authenticated Admin+ Arbitrary Directory Deletion vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin Connections versions = 10.4.66...

PT-2025-1189

Name of the Vulnerable Software and Affected Versions MGate 5121/5122/5123 Series firmware version v1.0 Description A stored Cross-site Scripting XSS vulnerability exists due to insufficient sanitization and encoding of user input in the Login Message functionality. An authenticated attacker with...

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...