PT-2025-22055 · Dkszone · Dkszone Eximius

Name of the Vulnerable Software and Affected Versions: dkszone Eximius versions n/a through 2.2 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 2.2, consider restricting file...

Fake CAPTCHA Attacks Deploy Infostealers and RATs in a Multistage Payload Chain

We have detected a new tactic involving fake CAPTCHA pages that trick users into executing harmful commands in Windows. This scheme uses disguised files sent via phishing and other malicious methods...

WordPress plugin Celestial Aura 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2025-4211

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

CVE-2025-4211 Improper Link Resolution Before File Access in QFileSystemEngine on Windows

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

CVE-2025-4211 Improper Link Resolution Before File Access in QFileSystemEngine on Windows

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

CVE-2025-4211

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

File Upload Vulnerability in MetaCRM of Beijing Meta Software Technology Co.

MetaCRM6 is a customer relationship management system. A file upload vulnerability exists in MetaCRM, which can be exploited by attackers to upload malicious files and gain server privileges...

Qt 后置链接漏洞

Qt is a cross-platform application development framework from the Qt open source. A backlink vulnerability exists in Qt versions 5.15.18 and earlier, 6.0.0 through 6.5.8, and 6.6.0 through 6.8.1, which stems from improper link resolution and can lead to symbolic link attacks and the use of...

Security advisory: Improper Link Resolution Before File Access in QFileSystemEngine in the Qt corelib module on Windows impacts Qt

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows potentially allows Symlink Attacks and the use of Malicious Files. This vulnerability has been discovered and assigned the CVE ID CVE-2025-4211. The issue originates...

CVE-2024-9238 AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2025-3916

CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary code while the end user opens a malicious project file SSD file provided by the attacker...

Vulnerabilities fixed in Adobe Animate

Adobe has fixed vulnerabilities in Animate versions 24.0.8, 23.0.11 and earlier. The vulnerabilities include a critical vulnerability that allows arbitrary code execution via an out-of-bounds write, a NULL Pointer Dereference that can lead to application crashes, and several integer-related...

PT-2025-21923 · V-Sft · V-Sft

Name of the Vulnerable Software and Affected Versions: V-SFT versions 6.2.5.0 and earlier Description: The issue is related to a stack-based buffer overflow in the VS6File!CTxSubFile::get ProgramFile name function. Opening specially crafted V7 or V8 files may lead to a crash, information...

The vulnerability of the Kibana data visualization service, related to the unlimited loading of malicious files, allows attackers to upload harmful files.

The vulnerability of the Kibana data visualization service is related to the unlimited loading of malicious files. Exploiting this vulnerability allows a remote attacker to upload malicious files...

CVE-2025-30330 Illustrator | Heap-based Buffer Overflow (CWE-122)

Illustrator versions 29.3, 28.7.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2025-20979 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel affected versions not specified Description: The issue is related to a use-after-free flaw in Microsoft Office Excel, allowing an unauthorized attacker to execute code locally. This can enable remote attackers to execut...

PT-2025-23778 · Delta Electronics · Cncsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics CNCSoft affected versions not specified Description: The issue is related to the lack of proper validation of user-supplied files in Delta Electronics CNCSoft. If a user opens a malicious file, an attacker can execute code i...

Cross-site Scripting (XSS)

n8n is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper MIME type handling in the attachments view endpoint, allowing malicious files to be interpreted as HTML and executed in the browser...

Elastic Kibana 安全漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic. A security vulnerability exists in Elastic Kibana versions prior to 8.13.0 that stems from insufficient server-side validation resulting in an authenticated attacker being able to upload malicious files...