CVE-2025-7746

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser...

CVE-2025-7746

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser...

CVE-2025-7746

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser...

CVE-2025-9364 Rockwell Automation FactoryTalk® Analytics™ LogixAI® Exposed Redis DB

An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data...

CVE-2025-40804

CVE-2025-40804 concerns Siemens’ SIMATIC Virtualization as a Service (SIVaaS). Affected: all versions; root cause is an unauthenticated network share exposed by the application, enabling an attacker to access or alter sensitive data without authorization. CVSS metrics from listed sources: v3.1 ba...

CVE-2025-9539

CVE-2025-9539 involves the WordPress plugin AutomatorWP ( Automator plugin for no-code automations, webhooks & custom integrations ) with a missing authorization check in the automatorwp_ajax_import_automation_from_url function. The vulnerability allows authenticated attackers with Subscriber-lev...

Siemens SIMATIC Virtualization as a Service 安全漏洞

Siemens SIMATIC Virtualization as a Service SIVaaS is an automation virtual machine from Siemens, Germany. A security vulnerability exists in Siemens SIMATIC Virtualization as a Service that originates from an unauthenticated network share, which could lead to unauthorized data access or...

appRain CMF SQL Injection Vulnerability (CNVD-2025-21133)

appRain CMF is a content management framework. appRain CMF suffers from an SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the data%5BPage%5D%5Bname%5D parameter of /apprain/page/manage-static-pages/create. An attacker could use this...

ROS-20250908-10

A vulnerability in the JSSE component of the Oracle Java SE software platform is related to insufficient validation of the of input data. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to modify, delete and read protected information using th...

ROS-20250908-09

A vulnerability in the JSSE component of the Oracle Java SE software platform is related to insufficient validation of the of input data. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to modify, delete and read protected information using th...

ROS-20250908-04

A vulnerability in Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM for JDK and Oracle Java SE software platform is related to incorrect input data validation in the 2D component of Oracle GraalVM. Oracle Java SE platform is related to incorrect input data validation in...

CVE-2025-7040

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

WordPress plugin Cloud SAML SSO 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress - WP Social Ninja exposed API Key

WordPress - WP Social Ninja exposed API Key Joshua Martinelle Thu, 09/04/2025 - 08:43 WP Social Media is a WordPress plugin that allows to integrate social media feeds such as Instagram Feed, Facebook Feed, social reviews such as Google Reviews, WooCommerce Reviews Pro, and chat widgets such as...

SQL Injection

pyloadng is vulnerable to SQL Injection. The vulnerability is due to improper handling of the addlinks parameter in the /json/addpackage API, which allows an attacker to modify or delete database data leading to errors or loss...

WordPress LWSCache plugin authorization issue vulnerability

WordPress LWSCache plugin is a caching plugin officially developed by WordPress, which is mainly used to optimize the loading speed of the website and improve SEO ranking. WordPress LWSCache plugin has an authorization issue vulnerability, the vulnerability stems from improper authorization of th...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Blind SQL Injection

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Blind SQL Injection Vulnerability Details CVEID:CVE-2025-0165 DESCRIPTION: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data is vulnerable to SQL injection. A remote attacker could send specially crafted SQL...

WordPress plugin LWSCache 授权问题漏洞

WordPress LWSCache plugin is a caching plugin officially developed by WordPress, which is mainly used to optimize the loading speed of the website and improve SEO ranking. WordPress LWSCache plugin has an authorization issue vulnerability, the vulnerability stems from improper authorization of th...

CVE-2024-13979

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

CVE-2024-13979 St. Joe ERP System SingleRowQueryConverter SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...