1108 matches found
WordPress plugin Comment Approved Notifier Extended 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
CVE-2025-2532 Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability
Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicio...
CVE-2024-53678 Apache VCL: SQL injection vulnerability in New Block Allocation form
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by th...
CVE-2025-30608 WordPress SQL Backup plugin <= 3.5.2 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup: from n/a through = 3.5.2...
AZL-77493 CVE-2025-30204 affecting package cf-cli for versions less than 8.4.0-27
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...
AZL-77514 CVE-2025-30204 affecting package keda for versions less than 2.4.0-32
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...
CVE-2025-26852
DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection...
CVE-2025-25040
CVE-2025-25040 affects HPE Aruba CX 9300 CX-9300 switches running AOS-CX. The issue is in port ACL enforcement on routed ports for egress traffic, allowing bypass of ACLs and potential unauthorized traffic flow. Affected: AOS-CX 10.14.xxxx (all patches) and 10.15.xxxx (10.15.1000 and below). Not ...
CVE-2025-24444
Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2025-24440
Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PT-2025-10865 · Adobe · Substance3D - Sampler
Name of the Vulnerable Software and Affected Versions: Substance3D - Sampler versions 4.5.2 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction,...
WordPress Advanced File Manager plugin <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Duc Manh in WordPress Plugin Advanced File Manager versions = 5.2.14...
Linux Distros Unpatched Vulnerability : CVE-2023-52798
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but t...
PT-2025-8684 · WordPress · The Essential Blocks – Page Builder Gutenberg Blocks
Name of the Vulnerable Software and Affected Versions: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress versions up to, and including, 5.2.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and...
Mautic 安全漏洞
Mautic is an open source marketing automation application. An arbitrary file upload vulnerability exists in Mautic versions prior to 5.2.3, which stems from insufficient validation of uploaded file extensions and improper handling of file paths. An attacker can exploit this vulnerability to uploa...
giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c.
...
CVE-2025-24903
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user...
CVE-2024-45290
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided...
PT-2025-5488 · Enituretechnology · Enituretechnology Small Package Quotes – Worldwide Express Edition
Name of the Vulnerable Software and Affected Versions: Eniture Technology Small Package Quotes – Worldwide Express Edition versions 5.2.17 and earlier Description: The issue is related to improper neutralization of special elements used in an SQL command, allowing SQL injection. This means an...
