12959 matches found
CVE-2025-14507
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names,...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: accel/qaic: Fixed the order of bootlog initialization. As soon as we queue MHI buffers to receive the bootlog from the device, we might be receiving data at the same time. Therefore, all resources necessary to process that dat...
Astra Linux – Vulnerability in binutils
A vulnerability was discovered in GNU Binutils 2.43 and is classified as problematic. The affected component is the function linkorderscan in the file ld/ldelfgen.c. Manipulation of this function leads to a memory leak. The attack can be launched remotely. The complexity of such an attack is quit...
CVE-2025-14507
CVE-2025-14507 — EventPrime for WordPress suffers unauthenticated sensitive information exposure via the REST API in all versions up to and including 4.2.7.0. Unauthenticated attackers could exfiltrate booking data (user names, emails, ticket details, payment information, and order keys) when the...
CVE-2025-14001
CVE-2025-14001 relates to the WordPress plugin WP Duplicate Page (versions
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a lock order reversal between nfcunregisterdevice and rfkillfopwrite, which could lead to a deadlock...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which originates from a worse-than-one error in the wireorder validation in the tiam335xtsc driver, which could lead to...
Linux Distros Unpatched Vulnerability : CVE-2025-71079
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: nfc: fix deadlock between nfcunregisterdevice and rfkillfopwrite A deadlock can occur between nfcunregisterdevice and rfkillfopwrite due to lock ordering...
PT-2026-2445
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names,...
Malware Detection Based on API Calls: A Reproducibility Study
This study independently reproduces the malware detection methodology presented by Felli cious et al. 7, which employs order-invariant API call frequency analysis using Random Forest classification. We utilized the original public dataset 250,533 training samples, 83,511 test samples and replicat...
EUVD-2023-40299
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
xmall security vulnerabilities
XMall is a distributed e-commerce shopping mall based on SOA architecture by the individual developer of Exrick. A security vulnerability exists in version 1.1 of xmall, which stems from improper access control of the /member/orderList API, and could lead to an attacker accessing other users' ord...
PT-2026-2300
Name of the Vulnerable Software and Affected Versions xmall version 1.1 Description An issue exists in xmall version 1.1 related to access control. Specifically, the /member/orderList API endpoint allows unauthorized access to other users' order details. This is achieved by manipulating the userI...
CVE-2023-36331: Authorization Bypass Through User-Controlled Key
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
CVE-2023-36331
The xmall distributed e-commerce shopping mall (version 1.1 ) contains an incorrect access control vulnerability in the /member/orderList API. An attacker can arbitrarily access other users' order details by manipulating the userId query parameter. Exploitation details are not provided, but the v...
CVE-2023-36331
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
CVE-2025-51626
SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancelorder.php endpoint...
CVE-2025-14886
The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the order REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order a...
CVE-2026-22588
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...