WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme ekommart versions 4.3.1...

WordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Protect WP Admin versions = 4.1...

Exploit for OS Command Injection in Vsftpd_Project Vsftpd

TP : Exploitation VSFTPD 2.3.4 Backdoor Table des Matières...

CVE-2025-13355 URL Shortify < 1.11.4 - Reflected XSS

The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

EUVD-2025-203313

A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is...

CVE-2023-36338

Inventory Management System 1 was discovered to contain a SQL injection vulnerability...

PT-2025-51317

Name of the Vulnerable Software and Affected Versions anirbandutta9 NEWS-BUZZ version 1.0 Description A SQL injection flaw exists in anirbandutta9 NEWS-BUZZ version 1.0. This allows a remote attacker to execute arbitrary code by using a crafted script. The vulnerability is due to insufficient inp...

CVE-2023-38913

SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script...

Kodezen Academy LMS 安全漏洞

Kodezen Academy LMS is a Learning Management System from Kodezen Inc. in the United States. A security vulnerability exists in Kodezen Academy LMS version 6.1, which stems from a file upload vulnerability that could lead to the upload of malicious SVG files and the execution of stored cross-site...

How-to Restore Lost Access to Cache Database After Using Custom SSL Certificate

Article Applicability This article is relevant only if the Veeam ONE deployment uses a custom SSL certificate, and not the one generated by the Veeam ONE installer. The error shown in the challenge section can also occur if the Veeam ONE Caching Service cannot access the PostgreSQL instance that...

PT-2025-51283

Name of the Vulnerable Software and Affected Versions Sunbird Power IQ versions prior to 9.2.1 Description An error-based SQL injection issue exists in the Power IQ API due to insufficient input validation when handling arrays in an outdated API endpoint. This allows manipulation of SQL queries...

PT-2025-51290

Name of the Vulnerable Software and Affected Versions Wp2Fac version 1.0 Description The software contains an OS command injection issue in the send.php endpoint. This allows remote attackers to execute arbitrary system commands. The issue occurs because attackers can inject shell commands throug...

CVE-2023-36338

CVE-2023-36338 affects Inventory Management System 1 with a SQL injection flaw caused by insufficient sanitization of user input before SQL queries. The exploitation details are not described in the provided documents, and there is no published fix in the connected sources; monitoring for updates...

IBM UrbanCode Deploy（IBM UCD）和IBM DevOps Deploy 代码问题漏洞

IBM UrbanCode Deploy IBM UCD and IBM DevOps Deploy are both products of International Business Machines IBM.IBM UrbanCode Deploy is a suite of application automation deployment tools. The tool is based on an application deployment automation management information model, and through remote agent...

NEWS-BUZZ 安全漏洞

NEWS-BUZZ is a news management system by ANIRBAN DUTTA Individual Developer that allows users to publish and manage a variety of news content. A security vulnerability exists in NEWS-BUZZ version v.1.0, which stems from vulnerability to SQL injection attacks and may lead to the execution of...

CVE-2023-38913

CVE-2023-38913 affects anirbandutta9 NEWS-BUZZ v.1.0. The connected sources specify a SQL injection vulnerability due to insufficient input validation in NEWS-BUZZ, which could allow a remote attacker to execute arbitrary code via a crafted script. Exploitation status is not confirmed in the docu...

PYSEC-2025-134

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is...

PYSEC-2025-134

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is...

CVE-2025-14651

A vulnerability has been found in MartialBE one-hub up to 0.14.27. This vulnerability affects unknown code of the file docker-compose.yml. The manipulation of the argument SESSIONSECRET leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attac...

CVE-2025-14651

The CVE concerns MartialBE one-hub up to version 0.14.27. The vulnerability arises from the docker-compose.yml configuration where the SESSION_SECRET is manipulated, leading to use of a hard-coded cryptographic key. Reported as exploitable remotely with high attack complexity, the issue is descri...