CVE-2024-55587

python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...

CVE-2023-48090

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extractattributes mediatools/m3u8.c:329...

CVE-2023-0159

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may ...

CVE-2022-4063

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers...

CVE-2021-39208

SharpCompress is a fully managed C library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to...

CVE-2021-35958

TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.getfile is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.getfile is not intended for untrusted archives...

Oracle Linux 9 : rpm-ostree (ELSA-2025-7147)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7147 advisory. 2025.5-1 - Rebase to 2025.5 Resolves: RHEL-78697 2025.4-1 - Rebase to 2025.4 Resolves: RHEL-68131 2025.3-1 - Rebase to 2025.3 Resolves: RHEL-68131 2025.2-1 -...

CVE-2025-46052

An error-based SQL Injection SQLi vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php...

CVE-2025-46578

There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information...

CVE-2025-46577

GoldenDB (ZTE) is affected by a SQL injection vulnerability where the application does not validate externally supplied SQL statements, enabling an attacker to execute arbitrary SQL and potentially exfiltrate data. Affected component: GoldenDB database product; root cause: lack of input validatio...

PT-2025-15919

Name of the Vulnerable Software and Affected Versions: Accredible Certificates & Open Badges plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to time-based SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied paramete...

PT-2025-12886

Name of the Vulnerable Software and Affected Versions The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress versions up to, and including, 1.6.8 Description The issue allows authenticated attackers with Contributor-level access and above t...

CVE-2024-12216

A vulnerability in the ImageClassificationDataset.fromcsv API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can...

PT-2025-12484

Name of the Vulnerable Software and Affected Versions Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit versions up to, and including, 3.5.1 Description The issue is related to SQL Injection via the automationId parameter due to insufficient...

PT-2025-12469

Name of the Vulnerable Software and Affected Versions WooCommerce Multivendor Marketplace – REST API plugin for WordPress versions up to, and including, 1.6.2 Description The issue allows authenticated attackers with Subscriber-level access and above to extract sensitive information from the...

CVE-2025-1311: Improper Neutralization of Special Elements used in an SQL Command

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the updatedeliverystatus function in all versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2025-25340

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The software suffers from an unknown read issue. The crash state involves the functions extract sess version, parse sdp session, and parse mixed content...

Unsafe Dependency Resolution

Overview kedro is a Kedro helps you build production-ready data and analytics pipelines Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the pullpackage API function. An attacker can execute arbitrary commands on the victim's machine by exploiting the...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the runtool command which exposes classes in the water.tools package via the ast parser. An attacker can shut down the server and write large files to arbitrary directories by exploiting the...

PT-2025-12187

Name of the Vulnerable Software and Affected Versions Vanna-ai version 0.6.2 Description The issue arises from insufficient protection against injecting additional SQL commands from user requests. This occurs when the generate sql function calls extract sql with the LLM response. An attacker can...