CVE-2025-57430

Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials...

PT-2025-39352

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.1.0 through 2.2.9 Description Flag Forge is a Capture The Flag CTF platform. The API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has...

CVE-2025-39872

CVE-2025-39872 concerns the Linux kernel function hsr_get_port_ndev. The issue arises because hsr_get_port_ndev calls hsr_for_each_port and requires both the RCU lock and a device reference, but returning the port device without proper synchronization could yield use-after-free in the caller. The...

U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████

A Cross-Site Scripting XSS vulnerability was discovered on an official domain from the Department of Defense. The vulnerability could be exploited through the GET method, allowing an attacker to inject malicious scripts that could potentially be executed. No further details were provided...

ROS-20250923-16

Vulnerability in Zabbix universal monitoring system is related to incorrect authorization check in the hostprototype.get method in Zabbix API. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information. remotely to gain access to...

CVE-2025-58653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JS Morisset JSM filegetcontents Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM filegetcontents Shortcode: from n/a through = 2.7.1...

CVE-2025-58653 WordPress JSM file_get_contents() Shortcode Plugin <= 2.7.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JS Morisset JSM filegetcontents Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM filegetcontents Shortcode: from n/a through = 2.7.1...

CVE-2025-55885

SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php...

CVE-2025-55885

SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php...

@conventional-changelog/git-client has Argument Injection vulnerability

Background on exploitation This vulnerability manifests with the library's getTags API, which allows specifying extra parameters passed to the git log command. In another API by this library - getRawCommits there are secure practices taken to ensure that the extra parameter path is unable to inje...

GHSA-VH25-5764-9WCR @conventional-changelog/git-client has Argument Injection vulnerability

Background on exploitation This vulnerability manifests with the library's getTags API, which allows specifying extra parameters passed to the git log command. In another API by this library - getRawCommits there are secure practices taken to ensure that the extra parameter path is unable to inje...

CVE-2025-57430

Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials...

Insecure Deserialization

picklescan is vulnerable to Insecure Deserialization. The vulnerability is due to the use of AutoComplete.getentity to execute remote pickle files, which allows an attacker to run arbitrary code on the target system...

PT-2025-38756

Name of the Vulnerable Software and Affected Versions Alpes Recherche et Developpement ARD GEC en Lign versions prior to 2025-04-23 Description A SQL Injection issue exists in Alpes Recherche et Developpement ARD GEC en Lign. A remote attacker can potentially escalate privileges by manipulating t...

Conventional Changelog 参数注入漏洞

Conventional Changelog is an open source update log generation tool from Conventional Changelog. A parameter injection vulnerability exists in Conventional Changelog versions prior to 2.0.0 that stems from not cleaning or validating user input in the getTags API, which could lead to a parameter...

CVE-2025-57430

The CVE-2025-57430 affects Creacast Creabox Manager 4.4.4, where a publicly accessible /get endpoint leaks internal configuration data, including the creacodec.lua file that contains plaintext admin credentials. This exposes sensitive configuration details and credential data via network access. ...

WordPress plugin JSM file_get_contents Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that provides the ability to host a personal blog site on a PHP and MySQL based server. A cross-site scripting...

CVE-2025-55885

SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php...

CVE-2025-57433

The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint /cwi/ajaxrequest/getdata.php, an authenticated attacker even with a low-privileged account like guest can retrieve the hashed passwords for the...

CVE-2025-57433

The CVE-2025-57433 entry concerns the 2wcom IP-4c device (version 2.15.5). A vulnerability in the web interface allows information disclosure via a crafted POST to /cwi/ajax_request/get_data.php. An authenticated user, even with low privileges (e.g., guest), can retrieve hashed passwords for admi...