2117 matches found
Seafile Community Edition 安全漏洞
Seafile Community Edition is a document collaboration platform from China's Haiwen Huzhi Seafile Company. A security vulnerability exists in Seafile Community Edition versions prior to 13.0.12, which stems from a stored cross-site scripting attack that could lead to malicious JavaScript execution...
CVE-2025-66032 Claude Code Command Validation Bypass Allows Arbitrary Code Execution
Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted...
CVE-2025-50361
Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v1228, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe in the function main.cpp, which can lead to potential information leakage and crash...
CVE-2025-13295
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.9...
CVE-2025-13295
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9...
CVE-2025-66216 AIS-catcher has a Buffer Overflow vulnerability in `AIS::Message` leading to DoS/RCE
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer. This issue has been...
CVE-2025-66384
app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmpname...
CVE-2025-66384
app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmpname...
CVE-2025-62497
Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unintended operations may be performed...
CVE-2025-60916
A reflected cross-site scripting XSS vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter...
Zyxel DX3301-T0 Resource Management Error Vulnerability
The Zyxel DX3301-T0 is a small wireless WiFi router produced by the Chinese company Zyxel. Versions of the Zyxel DX3301-T0 prior to 5.50ABVY.6.3C0 contained a resource management vulnerability. This vulnerability stemmed from uncontrolled consumption of resources by the web server; attackers coul...
SOPlanning 跨站脚本漏洞
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.55, which stems from a /feries endpoint that does not properly clean input and could lead to stored cross-site scripting...
CVE-2025-11963 Reflected XSS in Saysis's StarCities
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61...
EUVD-2025-198138
Out-of-bounds Read in Shelly Pro 3EM before v1.4.4 allows Overread Buffers...
CVE-2025-11243 Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
esm.sh 路径遍历漏洞
esm.sh is a content distribution network open-sourced by esm.sh. A path traversal vulnerability exists in versions prior to esm.sh 136, which stems from path traversal during the decompression of NPM packages, and could lead to arbitrary file writes...
VulnCheck KEV: CVE-2025-1302
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...
CVE-2025-12761
The Drupal Simple multi step form module is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 2.0.0 . The root cause is the improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts into web pages viewed by other user...
PT-2025-47290
Name of the Vulnerable Software and Affected Versions versions prior to 2.3 Description The commissioning wizard does not validate if the device is already initialized. This allows an unauthenticated remote attacker to construct HTTP POST requests to set or modify root credentials without...