The vulnerability in the web-based software modeling tool, Visual Composer, of the SAP NetWeaver software integration platform allows a hacker to gain access to and modify data.

The vulnerability of the Visual Composer web tool, a software modeling tool within the SAP NetWeaver integration platform, is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow an attacker to gain read and modify access to...

Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: CVE-2025-4447: Fixed buffer overflow in Eclipse OpenJ9 bsc1243429. CVE-2025-30698: Fixed 2D unauthorized data access and DoS bsc1241276. CVE-2025-30691: Fixed Compiler Unauthorized Data Access bsc1241275. CVE-2025-21587: Fixed unauthoriz...

CVE-2025-5815

The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcmmaybesetbotflags function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging...

PT-2025-25383

Name of the Vulnerable Software and Affected Versions The Traffic Monitor plugin for WordPress versions up to, and including, 3.2.2 Description The issue is related to unauthorized modification of data due to a missing capability check on the tfcm maybe set bot flags function. This allows...

CVE-2025-49196

CVE-2025-49196 is associated in connected sources with SICK Field Analytics and SICK Media Server, where the vulnerability stems from supporting a deprecated and unsafe TLS version. Impacts are described as affecting confidentiality and integrity; exploitation details are not provided, and public...

PT-2025-25351 · Aveva · Aveva Pi Connector For Cygnet

Name of the Vulnerable Software and Affected Versions: AVEVA PI Connector for CygNet versions 1.6.14 and prior Description: An improper validation of integrity check value issue exists that, if exploited, could allow a miscreant with elevated privileges to modify local data files in a way that...

PYSEC-2025-79

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

PYSEC-2025-74

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

PYSEC-2025-74

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

CVE-2025-3117

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...

Schneider Electric Modicon Controllers 跨站脚本漏洞

Schneider Electric Modicon Controllers are a series of Modicon series programmable logic controllers from Schneider Electric, France. A cross-site scripting vulnerability exists in Schneider Electric Modicon Controllers that originates from improper input neutralization during web page generation...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain access to read, modify, or delete data, or to cause a service failure.

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in an improper access to common directories due to incorrectly implemented authentication procedures. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data, or cause...

TOTOLINK T10 安全漏洞

The TOTOLINK T10 is a dual-band mesh networking router from TOTOLINK for full coverage needs of home and office networks. A buffer overflow vulnerability exists in TOTOLINK T10. The vulnerability stems from incorrect manipulation of the parameter desc in the file /cgi-bin/cstecgi.cgi. An attacker...

CVE-2025-5018

The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...

CVE-2025-5814

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...

CVE-2025-5814 Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...

CVE-2025-5814 Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...

WordPress plugin Profiler 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

SQL Injection

llamaindex is vulnerable to SQL Injection. The vulnerability is due to SQL injection due to improper handling of user input in multiple vector store integrations, allowing attackers to manipulate SQL queries and access or modify unauthorized data...

CVE-2025-5018

The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...