13189 matches found
CVE-2009-3337
SQL injection vulnerability in the Freetag serendipityeventfreetag plugin before 3.09 for Serendipity S9Y allows remote attackers to execute arbitrary SQL commands via an unspecified parameter associated with Meta keywords in a blog entry...
AZL-62426 CVE-2025-47947 affecting package mod_security 2.9.7-8
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case in stable released versions: when the payload's content type is application/json, and there is at...
CVE-2009-0303
Cross-site scripting XSS vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via vectors related to "encoded JavaScript" and Helpdesk.woa...
CVE-2005-3016
Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors...
USN-7526-1 bind9 vulnerability
It was discovered that Bind incorrectly handled certain DNS messages with invalid TSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service...
AZL-61972 CVE-2025-40775 affecting package bind for versions less than 9.20.9-1
When an incoming DNS protocol message includes a Transaction Signature TSIG, BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7...
WordPress Order Delivery Date Pro for WooCommerce plugin < 12.4.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Order Delivery Date for WP e-Commerce versions 12.4.0...
CVE-2025-37902
CVE-2025-37902 entry is rejected/not used and does not represent an active vulnerability.
AZL-61914 CVE-2025-23167 affecting package nodejs 20.14.0-13
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...
CVE-2025-23167
This CVE affects Node.js 20.x where the HTTP parser may terminate headers incorrectly (\r\n\rX instead of \r\n\r\n), enabling request smuggling and bypassing proxy-based access controls. Root cause: improper header termination in llhttp prior to version 9. The issue is resolved by upgrading llhtt...
๐ ABB Cylon FLXeon 9.3.5 siteGuide.js Authenticated Directory Traversal
The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated file traversal via the /api/siteGuide endpoint. An attacker with valid credentials can manipulate the filename parameter to move and access or overwrite arbitrary files. The issue arises due to improper input validation in...
๐ Samsung MagicINFO 9 Server Remote Code Execution
This Metasploit module exploits a remote code execution vulnerability in Samsung MagicINFO 9 Server versions less than or equal to 21.1050.0. Remote code execution can be obtained by exploiting the path traversal vulnerability CVE-2024-7399 in the SWUpdateFileUploader servlet, which can be querie...
Benchmarking LLMs in an Embodied Environment for Blue Team Threat Hunting
As cyber threats continue to grow in scale and sophistication, blue team defenders increasingly require advanced tools to proactively detect and mitigate risks. Large Language Models LLMs offer promising capabilities for enhancing threat analysis. However, their effectiveness in real-world blue...
CVE-2024-9711
creationtimestamp| type| source ---|---|--- 2025-05-16 20:34:48+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16747...
CVE-2025-39481 WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through 3.11.4...
SUSE CVE-2025-23167
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...
SAMSUNG Galaxy Watch3 Plugin ไฟกไปป็ฎก็้ฎ้ขๆผๆด
The SAMSUNG Galaxy Watch3 Plugin is a component of a Galaxy Wearable application from Samsung South Korea. A security vulnerability exists in SAMSUNG Galaxy Watch3 Plugin version 5.0.9 that stems from not properly validating TLS certificates, which could lead to a man-in-the-middle attack...
WordPress plugin WHMpress ๅฎๅ จๆผๆด
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
lockfile linting ๅฎๅ จๆผๆด
lockfile linting is a tool by Liran Tal Personal Developer. A security vulnerability exists in lockfile linting versions prior to 5.9.2, which stems from package URL validation being out of order, and could lead to the installation of unintended npm packages...
