15132 matches found
360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The 360 View plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...
CVE-2025-45956
A SQL injection vulnerability in managedamage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter...
Security Bulletin: IBM Security Guardium is affected by multiple kernel vulnerabilities
Summary IBM Security Guardium has addressed these vulnerabilities in an update Vulnerability Details CVEID:CVE-2024-26669 DESCRIPTION: Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a chain template offload flaw in net/sched. By sending a...
CVE-2025-45956
A SQL injection vulnerability in managedamage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter...
CVE-2025-45956
CVE-2025-45956 affects Sourcecodester Computer Laboratory Management System v1.0, via SQL injection in the file manage_damage.php. An authenticated attacker can leverage the vulnerable id parameter to execute arbitrary SQL commands, potentially compromising data integrity and confidentiality as r...
CVE-2025-45956
A SQL injection vulnerability in managedamage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter...
n8n Vulnerable to Stored XSS through Attachments View Endpoint
Impact n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there was no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allowed the server to respond with any MIME type, potentially...
CVE-2025-34491
GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup...
CVE-2025-34490 GFI MailEssentials < 21.8 XXE Arbitrary File Read
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...
CVE-2022-41871
SEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute arbitrary code in the context of the user root...
CVE-2022-41871
SEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute arbitrary code in the context of the user root...
CVE-2024-13808
The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for...
CVE-2022-41871
SEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute arbitrary code in the context of the user root...
CVE-2025-3280
The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attributevaluefilter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2025-2543
The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...
CVE-2025-32730
Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. surveillance cameras and recorders. This vulnerability allows a local authenticated attacker to use the authentication information from the last connected surveillance...
CVE-2025-3491 Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution
The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acptvalidatesetting' function. This is due to insufficient sanitization of the 'templatename' parameter. This makes it possib...
CVE-2025-3577
UNSUPPORTED WHEN ASSIGNED A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00AAJC.16C0 could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTTP request to an affected...
CVE-2025-3295
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive...