CVE-2025-64245 WordPress Import external attachments plugin <= 1.5.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through = 1.5.12...

CVE-2025-64245 WordPress Import external attachments plugin <= 1.5.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through = 1.5.12...

MAL-2025-192591 Malicious code in i18never (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 632dc2988c33d66794e0a132a9b305b8ea29788a777889291647e5a0514d51b2 The package i18never was found to contain malicious code. Source: ghsa-malware f8457dd91952dfd151549c2a5de56ff988a48ae31ebd0eae188e8a62999cb040 Any...

abp 安全漏洞

abp is an ABP open source web application framework. A security vulnerability exists in abp version 5.1.0 through versions prior to 10.0.0-rc.2, which stems from failure to properly validate the returnUrl parameter, which could result in a redirect to an arbitrary external domain...

PT-2025-51747

Name of the Vulnerable Software and Affected Versions PodcastGenerator version 3.2.9 Description The software contains a blind server-side request forgery issue that allows attackers to inject XML. This can be triggered by manipulating the shortdesc parameter in the episode upload form, enabling...

PT-2025-51393

Name of the Vulnerable Software and Affected Versions ryanpcmcquen Import external attachments versions through 1.5.12 Description The Import external attachments component contains a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access...

PT-2025-51748

Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicking a crafted SVG logo that redirects to a potentially dangerous URL through improper file upload filtering...

Information Leakage in Grafana Alerting

In Grafana’s alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role “Contact Point Writer”, which is part of the basic role Editor - can edit...

Honeywell PM43 Industrial Printers Files or Directories Accessible to External Parties (CVE-2023-3712)

Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Privilege Escalation. This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version...

Server-side Request Forgery (SSRF)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of page content by Twig templates when configuration permits undefined PHP functions to be...

Malicious code in @revvity-signals/chemdraw-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53a6ff6ab4af77539873f6d418625d58f5d11a3fedda42efb25b91585218bbf The package @revvity-signals/chemdraw-js was found to contain malicious code. Source: ghsa-malware...

Malicious code in sd-skbms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d7af5c9829af6d62bf3237e014e1a9a6cbcd30be7eb56096229f226428f607 The package sd-skbms was found to contain malicious code. Source: ghsa-malware 9cf1a086ee102f5bbaa7b18b6512f3457de46a88a240dd3acda1bcfffe28f58c Any...

MAL-2025-192572 Malicious code in phx-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b09229dc15cf8c3ce04a8a0a7e5cb43d43587ada9469f2a238c46a52927f94d The package phx-core was found to contain malicious code. Source: ghsa-malware 44cd2845eda5ed69922e3450a19b821ff762b61ea14e981648e9637faafcee3d Any...

Adobe ColdFusion XML External Entity References Improperly Restricted Vulnerability (CNVD-2026-0494441)

Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. Adobe ColdFusion suffers from an improperly restricted XML external entity...

Adobe ColdFusion XML External Entity References Improperly Restricted Vulnerability (CNVD-2026-0494343)

Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. Adobe ColdFusion suffers from an improperly restricted XML external entity...

VulnCheck KEV: CVE-2025-11700

N-central versions 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure...

Adobe ColdFusion XML External Entity References Improperly Restricted Vulnerability

Adobe ColdFusion is a dynamic Web server platform and application development framework maintained by Adobe for rapidly building and deploying data-driven dynamic Web sites, Web applications, and enterprise-class services. Adobe ColdFusion suffers from an improperly restricted XML external entity...

External Control Of System Or Configuration Setting

Taguette is vulnerable to External Control of System or Configuration Setting. The vulnerability is due to improper validation in the password reset functionality, which allows an attacker to craft a malicious reset link that, when clicked by the victim, enables unauthorized control over the...

XML External Entity (XXE) Injection

peppolpy is vulnerable to XML External Entity XXE injection. The vulnerability is due to insecure Saxon XML parser configuration, where external entities are allowed during XML invoice validation, enabling attackers to read local files and exfiltrate their contents to a remote host...

XML External Entity (XXE) Injection

Mustang is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper restriction of external entity references during XML processing, which allows an attacker to exploit XXE attacks to exfiltrate arbitrary files from the affected system...