15620 matches found
PT-2025-47335
Name of the Vulnerable Software and Affected Versions Kotaemon version 0.11.0 Description A cross site scripting XSS issue exists in Kotaemon version 0.11.0. This allows attackers to execute arbitrary code through a specially crafted PDF file. The issue involves the potential for malicious code...
CVE-2025-63227
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An attacker with administrative credentials can upload arbitrary files e.g., PHP webshells, which are stored in the /patch/ directory. This...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
CVE-2024-42749
Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script...
EUVD-2025-197651
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
CVE-2025-10686
The CVE-2025-10686 has concrete details across multiple sources: Creta Testimonial Showcase WordPress plugin prior to v1.2.4 is vulnerable to Local File Inclusion. Authenticated users with editor-level access or higher can include and execute arbitrary PHP files on the server, enabling code execu...
ZOHO ManageEngine Applications Manager Command Injection Vulnerability
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A command injection...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
EUVD-2025-175634
Malicious code in water-execute-rain-root-cloud npm...
EUVD-2025-179742
Malicious code in chi-short-export-assert-execute npm...
EUVD-2025-178986
Malicious code in execute-java-short-cluster-bundle npm...
EUVD-2025-179026
Malicious code in eta-refactor-execute-float-load npm...
EUVD-2025-178038
Malicious code in log-cron-execute-small-signal npm...
EUVD-2025-175553
Malicious code in wind-execute-authorize-mu-byte npm...
EUVD-2025-179091
Malicious code in epsilon-execute-pi-interpret-index npm...
MAL-2025-186895 Malicious code in execute-char-char-stub-serialize (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe5d9354bb43f2724bc7efeec94e26f50bce0f7ac425402af053df136cd5c11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179761
Malicious code in char-cat-execute-eta-authenticate npm...