CVE-2024-13794

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to...

PT-2025-6451 · WordPress · Wp Ghost

Name of the Vulnerable Software and Affected Versions: The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress versions up to, and including, 5.3.02 Description: The issue is due to the plugin not properly restricting the "/wp-register.php" path, making it possible for...

Astra Linux – Vulnerability in Zabbix

The HttpRequest object allows you to retrieve the HTTP headers from the server’s response after sending a request. The issue is that the returned strings are created directly from the data sent by the server and are not properly encoded for JavaScript. This enables the creation of internal string...

ABB Cylon FLXeon 9.3.4 runtimeSetup.sh Hidden Backdoor Account Vulnerability

ABB Cylon FLXeon version 9.3.4 has a hidden administrative account cxpro that has write access permissions to the device. ABB Cylon FLXeon 9.3.4 runtimeSetup.sh Hidden Backdoor Account Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi...

Elber Communications Equipment 安全漏洞

Elber Communications Equipment is a communications equipment from Elber Corporation. A security vulnerability exists in Elber Communications Equipment that stems from the presence of unauthenticated device configurations and the disclosure of hidden client functionality...

Apache Kvrocks 安全漏洞

Apache Kvrocks is a distributed key-value NoSQL database from the Apache USA Foundation. A security vulnerability exists in Apache Kvrocks version 2.11.0 and earlier, which stems from an undetected Host or POST in a REQ request, allowing valid HTTP requests to be processed as RESP requests, which...

ABB Cylon FLXeon 9.3.4 (runtimeSetup.sh) Hidden Backdoor Account

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

CVE-2025-0675 Elber Communications Equipment Hidden Functionality

Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure...

CVE-2025-0675 Elber Communications Equipment Hidden Functionality

Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure...

CVE-2025-0675

CVE-2025-0675 affects Elber products (Elber Communications Equipment). The public records describe an authentication bypass that enables unauthorized access to password management, effectively allowing attackers to overwrite any user password and gain access to protected areas of affected devices...

CVE-2024-21872

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

CVE-2024-30527

Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout Accept PayPal Payments allows Manipulating Hidden Fields.This issue affects WP Express Checkout Accept PayPal Payments: from n/a through 2.3.7...

CVE-2024-35244

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords e.g., by examining the coredump, these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refe...

ASB-A-352542820

In onCreateOptionsMenu of UserSettings.java, there is a possible way to remove the work profile by opening a hidden activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Lightning AI Studio Vulnerability Could've Allowed RCE via Hidden URL Parameter

Cybersecurity researchers have disclosed a critical security flaw in the Lightning AI Studio development platform that, if successfully exploited, could have allowed for remote code execution. The vulnerability, rated a CVSS score of 9.4, enables "attackers to potentially execute arbitrary comman...

CVE-2024-10001

A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including...

CVE-2024-10001 Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling

A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including...

CVE-2024-10001

GitHub Enterprise Server is affected by CVE-2024-10001. The vulnerability arises from an improper sequence of validation in the message handling function: the origin check occurs after accepting a user-controlled identity property, enabling a code injection via the query selector and exfiltration...

CVE-2024-10001 Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling

A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including...

PT-2025-1574 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.11.16 GitHub Enterprise Server versions prior to 3.12.10 GitHub Enterprise Server versions prior to 3.13.5 GitHub Enterprise Server versions prior to 3.14.2 GitHub Enterprise Server versions prior ...