33715 matches found
EUVD-2025-204826
Hugging Face Transformers HuBERT convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the...
EUVD-2025-204827
Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the...
EUVD-2025-204820
Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control parameters by tricking...
EUVD-2025-204825
CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...
EUVD-2025-204829
CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks...
EUVD-2025-204817
Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters. Attackers can inject malicious SQL code into parameters like oldprojectid, projectid, uuid, and uniqid to potentially extract...
EUVD-2025-204841
Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized...
EUVD-2025-204846
LangChain serialization injection vulnerability enables secret extraction...
EUVD-2025-204847
Cadmium CMS has a background arbitrary file upload vulnerability...
EUVD-2025-204870
Malicious code in start-log-backend npm...
EUVD-2025-204807
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Thembay Nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through 1.2.14...
EUVD-2025-204780
Malicious code in lanchain-openai PyPI...
EUVD-2025-204886
Malicious code in elf-stats-sprucey-cookie-492 npm...
EUVD-2025-204890
Malicious code in elf-stats-sleighing-hammer-902 npm...
EUVD-2025-204896
Malicious code in elf-stats-piney-train-884 npm...
EUVD-2025-204897
Malicious code in elf-stats-nutmeg-fir-716 npm...
EUVD-2025-204899
Malicious code in elf-stats-mistletoe-cookie-256 npm...
EUVD-2025-204906
Malicious code in elf-stats-fuzzy-ribbon-205 npm...