CVE-2025-25761: External Control of File Name or Path

HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php...

CVE-2025-1686: External Control of File Name or Path

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

CVE-2022-49199: Integer Underflow (Wrap or Wraparound)

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldevstatsetcounterdynamicdoit This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent underflows...

CVE-2024-13873: Authorization Bypass Through User-Controlled Key

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto function due to missing validation on a user controlled key. This makes it...

PT-2025-10140 · Crates.Io · Resolve

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The software's GitHub repository has been archived with no commits for seven years, and the latest release on crates.io is also seven years old. Recommendations: At the moment, there is no...

CVE-2024-13741: Server-Side Request Forgery (SSRF)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pmuploadimage function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2025-26819: Allocation of Resources Without Limits or Throttling

Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections...

CVE-2024-12651: Exposed Dangerous Method or Function

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2025-24811: Improper Resource Shutdown or Release

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0, SIMATIC S7-1200 CPU 1212C AC/DC/Rly 6ES7212-1BE40-0XB0, SIMATIC S7-1200 CPU 1212C DC/DC/DC...

VulnCheck KEV: CVE-2018-1217

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local...

GnuTLS 安全漏洞

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS. An attacker exploiting this vulnerability could send specially crafted certificates that could cause GnuTLS to become unresponsive or slow, resulting in a denial ...

CVE-2024-13850 Simple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject...

CVE-2024-13850: Improper Neutralization of Input During Web Page Generation

The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject...

CVE-2025-25075: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through = 2.0...

The vulnerability of the NTLMv2 authentication protocol implemented in Windows operating systems allows a hacker to carry out a Pass-the-hash attack.

The vulnerability of the NTLMv2 authentication protocol for Windows operating systems is related to the disclosure of hashes due to improper external manipulation of the name or file. Exploiting this vulnerability can allow a remote attacker to execute a Pass-the-hash attack...

CVE-2024-9047

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitatio...

CVE-2024-37063

A cross-site scripting XSS vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser...

PT-2025-5794 · Mintty · Mintty

Name of the Vulnerable Software and Affected Versions: Mintty affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this issue, where the target must visit a malicious...

CVE-2024-13425: Authorization Bypass Through User-Controlled Key

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete function due to missing validation on a user controlled key. This makes it...

CVE-2024-13429: Authorization Bypass Through User-Controlled Key

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the 'jobenforcedelete' due to missing validation on a user controlled key. This makes it possib...