4337 matches found
CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint
A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...
CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint
A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...
VulnCheck KEV: CVE-2009-1558
Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. encoded dot dot or an absolute pathname in the nextfile parameter...
Malicious code in next-pwa-template (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...
MAL-2025-4724 Malicious code in next-pwa-template (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...
CVE-2023-26001
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2...
CVE-2023-26001
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2...
CVE-2023-26001 WordPress Next Event Calendar <= 1.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2...
CVE-2023-26001 WordPress Next Event Calendar plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marchetti Design Next Event Calendar next-event-calendar allows Stored XSS.This issue affects Next Event Calendar: from n/a through = 1.2...
CVE-2023-26001
CVE-2023-26001 affects Next Event Calendar (WordPress plugin) up to version 1.2. The issue is a Stored XSS vulnerability caused by improper neutralization during web page generation. Public references in connected docs confirm the vulnerability type and affected version range, noting No explicit ...
WordPress plugin Next Event Calendar 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2023-26001: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2...
Clustering and Median Aggregation Improve Differentially Private Inference
Differentially private DP language model inference is an approach for generating private synthetic text. A sensitive input example is used to prompt an off-the-shelf large language model LLM to produce a similar example. Multiple examples can be aggregated together to formally satisfy the DP...
3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +582 more potentially affected by CVE-2025-48068 via next (>=15.0.0, <=15.2.1)
next NPM version =15.0.0, =1.5.0-beta.1, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.0, =0.1.20 and more Source cves: CVE-2025-48068 Source advisory: OSV:GHSA-3H52-269P-CP9R...
CVE-2024-8661
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with...
CVE-2024-38993
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
CVE-2024-1240
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other...
CVE-2023-37984
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10...
CVE-2023-30806
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to...