103 matches found
CVE-2024-58300
The CVE-2024-58300 affects Siklu MultiHaul TG series devices before version 2.0.0. An unauthenticated vulnerability allows remote attackers to retrieve randomly generated credentials by sending a specific hex-encoded command to port 12777, yielding the username and password and enabling direct SS...
CVE-2025-42615
Summary: CVE-2025-42615 affects Vulnerability-Lookup prior to 2.18.0 and stems from failing to rate-limit OTP attempts during 2FA, enabling brute-force style OTP submissions by an attacker with valid credentials. The concrete fix adds a persistent failed_otp_attempts counter, locks a user after 5...
CVE-2025-13295
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9...
CVE-2025-62497
Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unintended operations may be performed...
CVE-2025-12761
The CVE-2025-12761 issue affects Drupal’s Simple multi step form module (pre-2.0.0). The root cause is improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). Practical impact is that attacker-supplied content could be rendered as code in pages viewed b...
CVE-2025-24519
Buffer overflow for some IntelR QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially...
CVE-2025-62659
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting XSS.This issue affects MediaWiki CookieConsent extension: from v0.1.0 before v2.0.0...
PT-2025-41863
A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family incl. SIPLUS variants All versions V2.0.2, SIMATIC S7-1200 CPU V2 family incl. SIPLUS variants All versions V2.0.2. Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This...
EUVD-2025-30781
Malicious code in bioql PyPI...
CVE-2025-41095 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference IDOR vulnerability in BOLD Workplanner in versions prior to 2.5.25 4935b438f9b, consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers...
CVE-2025-11025
Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data. This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0...
CVE-2025-58628
CVE-2025-58628 refers to a SQL injection vulnerability in the WordPress theme Miraculous (versions before 2.0.9). The issue is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection. Public writeups and vulnerability feeds confirm affected software as ...
CVE-2025-27559
Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enable escalation of privilege via local access...
ed25519-dalek crate 安全漏洞
ed25519-dalek crate is a Rust library from dalek cryptography open source. A security vulnerability exists in versions prior to ed25519-dalek crate 2, which stems from a dual public key signing function leading to private key extraction...
WordPress plugin Tracking Code Manager 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
PT-2025-5133 · Unknown · Suryabhan Custom Coming Soon
Name of the Vulnerable Software and Affected Versions: SuryaBhan Custom Coming Soon versions prior to 2.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...
VulnCheck KEV: CVE-2024-32739
A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptaskverbose" function within MCUDBHelper...
PT-2024-36321 · Unknown · Mohamed Riyaz Admin Customization
Name of the Vulnerable Software and Affected Versions: Mohamed Riyaz Admin Customization versions prior to 2.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on...
