WordPress List category posts SQL Injection Vulnerability

WordPress List category posts is a feature-rich WordPress plugin , mainly through the catlist short code to achieve the function . WordPress List category posts has a SQL injection vulnerability, the vulnerability stems from the existence of the startingwith parameter time-based SQL injection, an...

SeBERTis: A Framework for Producing Classifiers of Security-Related Issue Reports

Monitoring issue tracker submissions is a crucial software maintenance activity. A key goal is the prioritization of high risk, security-related bugs. If such bugs can be recognized early, the risk of propagation to dependent products and endangerment of stakeholder benefits can be mitigated. To...

The vulnerability of the import_flow function in the framework for developing applications using large language models like db-gpt allows a hacker to execute arbitrary code.

The vulnerability of the importflow function in the framework for developing applications using large language models like db-gpt is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a remote attacker to execute...

PT-2025-51561

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dish trade detail get. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is no...

PT-2025-51444

Name of the Vulnerable Software and Affected Versions LambertGroup xPromoter versions through 1.3.4 Description A flaw exists in LambertGroup xPromoter that allows for Blind SQL Injection due to improper neutralization of special elements used in an SQL command. This issue could potentially allow...

The vulnerability of the FactoryTalk DataMosaix Private Cloud data management platform and production process optimization, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the FactoryTalk DataMosaix Private Cloud data management platform and its production process optimization capabilities is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

EUVD-2025-203469

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...

CVE-2025-58173

FreshRSS (self-hosted RSS aggregator) is affected by a path traversal in the language configuration parameter that existed in versions 1.23.0–1.27.0. An unprivileged user could call install.php and perform administrative actions, including logging in as admin, creating a new admin user, or config...

CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...

CVE-2023-53877

Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickupid parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal information from the database...

CVE-2023-53870

Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information...

GO-2025-4233 HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go

HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go...

CVE-2023-53870 Jorani 1.0.3 Cross-Site Scripting Vulnerability via Language Parameter

Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information...

CVE-2023-53870

CVE-2023-53870 concerns Jorani 1.0.3, which has a reflected XSS vulnerability in the language parameter. An attacker can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information. Public sources in the connected documents consisten...

CVE-2023-53870 Jorani 1.0.3 Cross-Site Scripting Vulnerability via Language Parameter

Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information...

CVE-2025-14148 IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token...

CVE-2025-14668

A vulnerability was detected in campcodes Advanced Online Examination System 1.0. This affects an unknown function of the file /query/loginExe.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now publi...

CVE-2025-14711 FantasticLBP Hotels Server hotelList.php sql injection

A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This manipulation of the argument pickedHotelName/type causes sql injection. The attack is possible to be carried...

CVE-2025-14639

A vulnerability was detected in itsourcecode Student Management System 1.0. Impacted is an unknown function of the file /uprec.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used...

Security and Detectability Analysis of Unicode Text Watermarking Methods against Large Language Models

Securing digital text is becoming increasingly relevant due to the widespread use of large language models. Individuals' fear of losing control over data when it is being used to train such machine learning models or when distinguishing model-generated output from text written by humans. Digital...