PT-2025-38804

Name of the Vulnerable Software and Affected Versions Ays Pro Poll Maker versions through 6.0.1 Description Ays Pro Poll Maker is susceptible to a DOM-Based Cross-site Scripting issue due to improper input neutralization during web page generation. This allows for the injection of malicious scrip...

WordPress plugin Penci Shortcodes & Performance 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which has the ability to host personal blog sites on PHP and MySQL based servers.WordPres...

PT-2025-39055

Name of the Vulnerable Software and Affected Versions PenciDesign Penci Recipe versions through 4.0 Description The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-site Scripting issue. This allows for the potential execution ...

WordPress plugin Bg Church Memos 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

PT-2025-38909

Name of the Vulnerable Software and Affected Versions bestweblayout Portfolio versions through 2.58 Description The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-Site Scripting XSS issue. This allows for potential malicious co...

PT-2025-38676

Name of the Vulnerable Software and Affected Versions JSC R7 R7-Office Document Server versions up to 20250820 Description A flaw exists in JSC R7 R7-Office Document Server. The issue involves manipulation of the cmd argument within an unknown function of the /downloadas/ file, potentially leadin...

PT-2025-39037

Name of the Vulnerable Software and Affected Versions Coderz Studio Custom iFrame for Elementor versions through 1.0.13 Description An issue exists in Coderz Studio Custom iFrame for Elementor that allows for DOM-Based Cross-site Scripting XSS. The issue is due to improper neutralization of input...

JSC R7 R7-Office Document Server 路径遍历漏洞

JSC R7 R7-Office Document Server is an office software from the Russian company JSC R7. A path traversal vulnerability exists in JSC R7 R7-Office Document Server 20250820 and earlier versions, which stems from incorrect manipulation of the parameter cmd in the file /downloadas/, which could lead ...

PT-2025-38891

Name of the Vulnerable Software and Affected Versions iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions through 1.16.16 Description A flaw exists in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery that allows the retrieval of embedded sensitive...

WordPress plugin Directory Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

The vulnerability of file pdf_fmap.c in the TTF component of the software for processing, transforming, and generating Ghostscript documents allows a hacker to trigger a service failure.

The vulnerability of file pdffmap.c in the TTF component of the software for processing, transforming, and generating Ghostscript documents is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-8532

Authorization Bypass Through User-Controlled Key, CWE - 862 - Missing Authorization, – Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows – Exploitation of Trusted Identifiers, – Exploitation of Authorization, – Variable...

CGA-HCJH-FFF7-G5RC

Bulletin has no description...

Unauthorized Access

Liferay Portal is vulnerable to Unauthorized Access. The vulnerability is due to improper access control because unauthenticated users guests can access files uploaded by object entries and stored in documentlibrary via direct URL...

CVE-2025-8532

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166...

CVE-2025-8532

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166...

CVE-2025-8532 IDOR in Bimser's eBA Document and Workflow Management System

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166...

CVE-2025-8532 IDOR in Bimser's eBA Document and Workflow Management System

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166...

CVE-2025-8532

The CVE-2025-8532 entry concerns Bimser Solution Software Trade Inc. EBA Document and Workflow Management System, affected versions 6.7.164 up to 6.7.165 (prior to 6.7.166). The issue is described as an Authorization Bypass Through User-Controlled Key (improper authorization) that enables forcefu...

Denial Of Service (DoS)

Liferay Portal is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient restrictions on file uploads through forms, which are stored in the documentlibrary, allowing an attacker to upload unlimited files and cause a potential DDoS...