CVE-2025-22894: Unprotected Windows Messaging Channel

Unprotected Windows messaging channel 'Shatter' issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a...

CVE-2025-24845: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in a command 'Argument Injection' issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause ...

PT-2025-5806 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: A NULL pointer dereference issue exists, allowing an attacker to cause a denial-of-service DoS condition by providing specially crafted data to a specific process of the...

PT-2025-5802

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue allows an attacker to obtain SYSTEM privilege of the Windows system where the product is running by performing a specific operation. This is due to an executio...

CVE-2025-22890: Execution with Unnecessary Privileges

Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained...

CVE-2025-23236: Buffer Copy without Checking Size of Input

Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained...

CVE-2022-46869

Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office Windows before build 40278, Acronis True Image OEM Windows before build 42575...

CVE-2022-44733

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office Windows before build 39900...

CVE-2022-44732

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office Windows before build 39900...

Multiple vulnerabilities in Defense Platform Home Edition

Overview Defense Platform Home Edition provided by Humming Heads Inc. contains multiple vulnerabilities listed below. Improper handling of message in specific process CWE-422 - CVE-2025-20094 Execution with unnecessary privileges CWE-250 - CVE-2025-22890 Improper handling of message in specific...

CVE-2024-53781

Cross-Site Request Forgery CSRF vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Stored XSS.This issue affects SpatialMatch IDX: from n/a through = 3.0.9...

Malicious code in @sn4k-s3c/call-home (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress flexIDX Home Search plugin <= 2.1.2 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin FlexIDX Home Search versions = 2.1.2...

CVE-2024-13225

The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13225

The ECT Home Page Products WordPress plugin (versions 1.9 and earlier ) is vulnerable to Reflected Cross-Site Scripting (XSS) due to a lack of proper sanitization and escaping of a parameter before it is outputted back to the page. An attacker could exploit this by tricking a victim, such as an a...

CVE-2024-13225 ECT Home Page Products <= 1.9 - Reflected XSS

The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-23920

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the onboardee module. The issue results from improper...

CVE-2024-23921

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanapp module. The issue results from the lack of...

CVE-2024-23921 ChargePoint Home Flex Command Injection

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanapp module. The issue results from the lack of...

CVE-2024-23921 ChargePoint Home Flex Command Injection

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanapp module. The issue results from the lack of...