PT-2025-53918

Name of the Vulnerable Software and Affected Versions Kraft Plugins Demo Importer Plus versions through 2.0.8 Description The Demo Importer Plus plugin contains a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access. This issue impacts th...

URI 安全漏洞

URI is a Ruby open source module that provides classes to handle Uniform Resource Identifiers. A security vulnerability exists in URI versions prior to 0.12.5, 0.13.3, and 1.0.4, which stems from the possibility that sensitive information such as passwords in the original URI may be disclosed whe...

PT-2025-54229

A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attac...

CVE-2025-15360: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attac...

WordPress plugin Demo Importer Plus 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-69091: Missing Authorization

Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through = 2.0.8...

newbee-mall-plus 安全漏洞

newbee-mall-plus is an open source e-commerce system by newbee-ltd. A security vulnerability exists in version 2.0.0 of newbee-mall-plus, which stems from the incorrect manipulation of the parameter File in the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java, which coul...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992501)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992501 advisory. In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: Fix refcount leak in omap3xxxprmlateinit offindmatchingnode returns a node pointer...

CVE-2025-15133

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2apiCloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit...

CVE-2025-15132

A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2apiopen of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has...

ManageEngine Exchange Reporter Plus Service Outage

The vulnerability of the Content Search module in the ManageEngine Exchange Reporter Plus monitoring, analysis, and reporting tool is related to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow a malicious actor to cause service...

Instant Search XSS

The vulnerability of the Instant Search function in the Content Search module of the ManageEngine Exchange Reporter Plus software exists because measures to protect the website structure have not been taken. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

ManageEngine Exchange Reporter Plus XSS

The vulnerability of the Reports module in the ManageEngine Exchange Reporter Plus software monitoring, analysis, and reporting tool exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

EUVD-2025-205507

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2apiCloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit...

EUVD-2025-205505

A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2apiSafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made publ...

EUVD-2025-205504

A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2apiopen of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-15133

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2apiCloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit...

CVE-2025-15132

A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2apiopen of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-15133 ZSPACE Z4Pro+ HTTP POST Request close zfilev2_api_CloseSafe command injection

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2apiCloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit...

CVE-2025-15132

Summary: CVE-2025-15132 affects ZSPACE Z4Pro+ 1.0.0440024. The vulnerable component is the HTTP POST Request Handler, specifically the function zfilev2_api_open in the file path /v2/file/safe/open. This manipulation enables command injection and can be triggered remotely. Public disclosure of the...