TencentOS Server 4: moby (TSSA-2025:0667)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0667 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Arbitrary Code Injection

Overview rdsearchlogic is a Searchlogic makes using ActiveRecord named scopes easier and less repetitive. Affected versions of this package are vulnerable to Arbitrary Code Injection via the searchinstanceeval parameter, which is dynamically invoked using the send method. An attacker can execute...

Linux Distros Unpatched Vulnerability : CVE-2025-31651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was...

Linux Distros Unpatched Vulnerability : CVE-2019-9946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI...

WordPress WPC Smart Quick View for WooCommerce plugin <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via woosqbtn Shortcode vulnerability discovered by zaim in WordPress Plugin WPC Smart Quick View for WooCommerce versions = 4.2.1...

CVE-2025-55740

nginx-defender is a high-performance, enterprise-grade Web Application Firewall WAF and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml...

CVE-2025-55740

CVE-2025-55740 affects nginx-defender, a WAF/threat-detection system. The vulnerability is a configuration flaw where default credentials in example files (config.yaml and docker-compose.yml) are left unchanged (default_password: change_me_please; GF_SECURITY_ADMIN_PASSWORD=admin123). If exposed ...

CVE-2025-55740 Default Credentials in nginx-defender Configuration Files

nginx-defender is a high-performance, enterprise-grade Web Application Firewall WAF and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml...

CVE-2025-55303

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include a...

CVE-2025-55294

screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary...

CVE-2025-55294 Command Injection via `format` option in screenshot-desktop

screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary...

CVE-2025-55294 Command Injection via `format` option in screenshot-desktop

screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary...

CVE-2025-55294 Command Injection via `format` option in screenshot-desktop

screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary...

CVE-2025-51539

EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem...

WordPress Funnel Builder by FunnelKit Plugin <= 3.11.1 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Funnel Builder by FunnelKit versions = 3.11.1...

WordPress CubeWP Framework Plugin <= 1.1.24 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin CubeWP versions = 1.1.24...

WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Simple Business Directory Pro versions 15.6.9...

WordPress ColorMag Theme <= 4.0.19 is vulnerable to Broken Access Control

Software ColorMag Type Theme Vulnerable versions = 4.0.19 Fixed in 4.0.20 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-9202 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 43bacb806b7e Credits Dmitrii Ignatyev Required privilege...

Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2025-2964)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2964 advisory. GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files...

CVE-2025-51540

EzGED3 3.5.0 stores passwords using an insecure hashing chain md5(md5(password)) with no salt, enabling offline brute-force attacks if hashes are exposed. Affected versions include 3.5.0 through 3.5.72.27183. Vendor states fix in 3.5.72.27183. Remediation: upgrade to 3.5.72.27183 or later.