Yordam Library Automation System SQL注入漏洞

Yordam Library Automation System is an application from Yordam, Inc. A SQL injection vulnerability exists in Yordam Library Automation System versions 21.5, 21.6, and prior to 21.7, which stems from improper neutralization of a special element and could lead to a SQL injection attack...

Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Input Validation (CVE-2025-8007)

A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Major Non-Recoverable MNFR fault. This condition may lead to unexpected system crashes and loss of device availability. This plugin only works...

Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Handling of Exceptional Conditions (CVE-2025-8008)

A security issue exists in the protected mode of EN4TR devices, where sending specifically crafted messages during a Forward Close operation can cause the device to crash. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

ABB FLXEON 信任管理问题漏洞

ABB FLXEON is a family of building automation controllers from ABB Switzerland. ABB FLXEON 9.3.5 and earlier versions and later versions are vulnerable to a trust management issue that stems from the use of hard-coded credentials...

ABB FLXEON 安全漏洞

ABB FLXEON is a series of building automation controllers from ABB Switzerland. A security vulnerability exists in ABB FLXEON version 9.3.5 and earlier, which stems from the use of one-way hashing with predictable salt values...

GHSA-65HM-PWJ5-73PW @executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode

The MCP Server provided by ExecuteAutomation at https://github.com/executeautomation/mcp-database-server provides an MCP interface for agentic workflows to interact with different kinds of database servers such as PostgreSQL database. However, the mcp-database-server MCP Server distributed via th...

oasys 安全漏洞

oasys is an OA office automation system by the individual developer misstt123. A security vulnerability exists in oasys version 1.1, which stems from a misuse of the parameter aleph in the file src/main/Java/cn/gson/oasys/controller/address/AddrController, which could lead to an SQL injection...

China-Linked AI Pentest Tool ‘Villager’ Raises Concern After 10K Downloads

China-linked AI tool Villager, published on PyPI, automates cyberattacks and has got experts worried after 10,000 downloads in…...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for August 2025.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 25.0.0-IF001 Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be us...

Delta Electronics DIALink Directory Traversal Vulnerability (CNVD-2025-22947)

Delta Electronics DIALink is an industrial automation communication gateway from Delta Electronics China. A directory traversal vulnerability exists in Delta Electronics DIALink, which can be exploited by an attacker to cause authentication bypass...

Pentest-scripts

Pentest-scripts Personal repository with offensive secur...

msdat

This is an offensive tool for Microsoft SQL Server MSSQL database exploitation. The tool is called "MSDAT" and is designed to perform various attacks on MSSQL databases, including reading and writing files, executing system commands, and more. The tool uses a variety of techniques, including OLE...

AI browsers or agentic browsers: a look at the future of web surfing

Browsers like Chrome, Edge, and Firefox are our traditional gateway to the internet. But lately, we have seen a new generation of browsers emerge. These are AI-powered browsers or "agentic browsers"—which are not to be confused with your regular browsers that have just AI-powered plugins bolted o...

Security Bulletin: Multiple vulnerabilities in NodeJS affect IBM Business Automation Workflow Configuration Editor

Summary IBM Business Automation Workflow Configuration Editor packages a vulnerable version of the NodeJS runtime and a vulnerable module. Vulnerability Details CVEID:CVE-2025-23165 DESCRIPTION: In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server traditional shipped with IBM Buinses Automation Workflow (CVE-2025-48976)

Summary WebSphere Application Server traditional is shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security...

Security Bulletin: Multiple security vulnerabilities in Java affect IBM Business Automation Workflow - July 2025 CPU

Summary WebSphere Application Server traditional is shipped as a component of IBM Business Automation Workflow and requires IBM Java 8. Information about security vulnerabilities in IBM Java 8 have been published. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fix...

CVE-2025-9539

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwpajaximportautomationfromurl function in all versions up to, and...

Rockwell Automation ThinManager Server-Side Request Forgery Vulnerability

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers simultaneously. A server-side request forgery vulnerability exists in Rockwell Automation ThinManager, which stems from...

Rockwell Automation FactoryTalk Activation Manager Data Exposure Vulnerability

Rockwell Automation is a leading global provider of industrial automation and control solutions focused on helping companies achieve smart manufacturing and digital transformation. A data disclosure vulnerability exists in Rockwell Automation FactoryTalk Activation Manager, which can be exploited...

erjinzhi 10OA 代码注入漏洞

erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A code injection vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect manipulation of the parameter Name in the file /trial/mvc/finder, and could lead to a cross-site scripting attack...