CVE-2025-7079

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonpath-plus-0.19.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonpath-plus-0.19.0.tgz Vulnerability Details CVEID:CVE-2024-21534 DESCRIPTION: All versions of the package jsonpath-plus are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can...

The vulnerability of the built-in web server boa (/boafrm/formPortFw) of TOTOLINK N302R Plus router’s microprogramming software allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formPortFw of TOTOLINK N302R Plus router microprogramming software is related to the escape of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failu...

CVE-2025-7079

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

CVE-2025-7079 mao888 bluebell-plus JWT Token jwt.go hard-coded password

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

CVE-2025-7079 mao888 bluebell-plus JWT Token jwt.go hard-coded password

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

CVE-2025-49431

Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through = 1.1...

bluebell-plus 安全漏洞

bluebell-plus is a blog forum web project by ChaoHu personal developer. A security vulnerability exists in bluebell-plus version 2.3.0 and earlier, which stems from the use of a hard-coded password for the parameter mySecret in the bluebellbackend/pkg/jwt/jwt.go file...

PT-2025-28072 · Unknown · Mao888 Bluebell-Plus

Name of the Vulnerable Software and Affected Versions: mao888 bluebell-plus versions up to 2.3.0 Description: A problematic vulnerability has been found in the JWT Token Handler component, affecting the processing of the file bluebell backend/pkg/jwt/jwt.go. The issue involves the manipulation of...

CVE-2025-49431

Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through = 1.1...

CVE-2025-49431 WordPress MF Plus WPML plugin <= 1.1 - Settings Change Vulnerability

Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through = 1.1...

CVE-2025-49431

CVE-2025-49431 concerns the WordPress MF Plus WPML plugin with versions ≤ 1.1, described as a Missing Authorization / Settings Change vulnerability. Connected sources confirm an access-control misconfiguration that allows unauthorized settings changes, with CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:...

CVE-2025-49431 WordPress MF Plus WPML plugin <= 1.1 - Settings Change Vulnerability

Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through = 1.1...

ManageEngine Exchange Reporter Plus RCE

The version of ManageEngine Exchange Reporter Plus on the Host is prior to 5722. It is, therefore, affected by an RCE Vulnerability where Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module. Note that Nessus has...

PT-2025-27926 · Unknown · Gnuget Mf Plus Wpml

Name of the Vulnerable Software and Affected Versions: Gnuget MF Plus WPML versions 1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Gnuget MF Plus WPML...

ManageEngine Exchange Reporter Plus Multiple Vulnerabilities

The version of ManageEngine Exchange Reporter Plus on the host is prior to 5723. It is, therefore, affected by multiple XSS vulnerabilities - Zohocorp ManageEngine Exchange Reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. CVE-2025-59...

CVE-2025-46259

Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7...

WordPress MF Plus WPML plugin <= 1.1 - Settings Change Vulnerability

Settings Change Vulnerability discovered by Mika in WordPress Plugin MF Plus WPML versions = 1.1...

CVE-2025-6925

A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath...

uri: userinfo leakage in URI#join, URI#merge and URI#+

A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URIjoin, URImerge, and URI+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using...