CVE-2025-5400 chaitak-gorai Blogbook GET Parameter user.php sql injection

A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown function of the file /user.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. It is...

CVE-2025-5400

CVE-2025-5400 affects the Blogbook product by Chaitak-Gorai, in the file /user.php (GET Parameter Handler). The vulnerability arises from unsafely handling the parameter u_id , enabling remote SQL injection. It is described as critical with potential high impact on confidentiality, integrity, and...

CVE-2025-5400: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown function of the file /user.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. It is...

CVE-2025-5404: Improper Resource Shutdown or Release

A vulnerability classified as problematic was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This vulnerability affects unknown code of the file /search.php of the component GET Parameter Handler. The manipulation of the argument Search leads to denial of service...

CVE-2025-5403: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This affects an unknown part of the file /admin/viewallposts.php of the component GET Parameter Handler. The manipulation of the argument postid leads to sql injection. ...

PT-2025-23429 · Unknown · Chaitak-Gorai Blogbook

Name of the Vulnerable Software and Affected Versions: chaitak-gorai Blogbook versions up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 Description: A critical issue affects some unknown functionality of the file /admin/includes/edit post.php of the component GET Parameter Handler. The manipulation...

PT-2025-23427 · Unknown · Chaitak-Gorai Blogbook

Name of the Vulnerable Software and Affected Versions: Chaitak-gorai Blogbook versions up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 Description: A critical vulnerability was found in Chaitak-gorai Blogbook, affecting an unknown functionality of the file /post.php of the component GET Parameter...

CVE-2025-5401: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /post.php of the component GET Parameter Handler. The manipulation of the argument pid leads...

PT-2025-23430 · Unknown · Chaitak-Gorai Blogbook

Name of the Vulnerable Software and Affected Versions: chaitak-gorai Blogbook affected versions not specified Description: A critical vulnerability has been found in chaitak-gorai Blogbook. The issue affects the GET Parameter Handler component, specifically the post id argument in the /admin/view...

CVE-2025-48046

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...

FreeFloat FTP Server GET Command Handler Component Buffer Overflow Vulnerability

FreeFloat FTP Server is an FTP service from FreeFloat. A buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0, which stems from the GET Command Handler component failing to properly validate the length size of the input data, no details of the vulnerability are provided at...

CVE-2024-51392

An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component...

CVE-2025-48389

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the ge...

CVE-2025-48046

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...

CVE-2025-48045

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials...

CVE-2025-48046

CVE-2025-48046 involves an authenticated user disclosing the cleartext password of a configured SMTP server via an HTTP GET to /config.php. The connected Red Hat entries describe the vulnerability as an authenticated-access issue that exposes SMTP credentials through the /config.php endpoint. The...

CVE-2025-48046 MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...

CVE-2025-48045

CVE-2025-48045 is an unauthenticated risk in the NetFax Server family where an HTTP GET to /client.php discloses the default administrator credentials. The entry carries CVSS v4.0 base metrics (AV:N/AC:L/PR:N/UI:N/SI:N/VI:N/VA:N; Confidentiality High). Red Hat and NVD records corroborate the exac...

CVE-2025-48045 MICI Network Co. Ltd. NetFax Server Default Administrator Credentials Disclosure

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials...

GHSA-22V8-P7H2-RJ7P Markdownify MCP Server allows attackers to read arbitrary files

All versions of the package mcp-markdownify-server are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool. An attacker can craft a prompt that, once accessed by the MCP host, will allow it to read arbitrary files from the host running the server...