CVE-2025-48781: External Control of File Name or Path

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...

firefox: thunderbird: Out-of-bounds access when optimizing linear sums

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker could perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes...

CVE-2025-27444: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin o...

CVE-2025-4330

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

CVE-2025-46807: Allocation of Resources Without Limits or Throttling

A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4...

Mozilla Firefox Security Update (mfsa_2025-42) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

firefox: thunderbird: Out-of-bounds access when resolving Promise objects

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object...

CVE-2024-31939

Cross-Site Request Forgery CSRF vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: from n/a through 3.7.3...

CVE-2023-41858

Cross-Site Request Forgery CSRF vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin = 1.2 versions...

CVE-2023-23806

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Davinder Singh Custom Settings plugin = 1.0 versions...

CVE-2023-36517

Cross-Site Request Forgery CSRF vulnerability in Kevon Adonis WP Abstracts plugin = 2.6.2 versions...

CVE-2023-46208

Unauth. Reflected Cross-Site Scripting XSS vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin = 1.4.6 versions...

CVE-2023-37392

Cross-Site Request Forgery CSRF vulnerability in Deepak Anand WP Dummy Content Generator plugin = 2.3.0 versions...

CVE-2023-22696

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Custom4Web Affiliate Links Lite plugin = 2.5 versions...

CVE-2023-26516

Cross-Site Request Forgery CSRF vulnerability in WPIndeed Debug Assistant plugin = 1.4 versions...

CVE-2023-44239

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jobin Jose WWM Social Share On Image Hover plugin = 2.2 versions...

CVE-2023-35780

Cross-Site Request Forgery CSRF vulnerability in Andy Whalen Galleria plugin = 1.0.3 versions...

CVE-2023-46122

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorizedkeys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however...

CVE-2023-47687

Cross-Site Request Forgery CSRF vulnerability in VJInfotech Woo Custom and Sequential Order Number plugin = 2.6.0 versions...

CVE-2024-7803: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS...