CVE-2025-45468: Incorrect Permission Assignment for Critical Resource

Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account...

CVE-2025-41403: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data...

CVE-2025-3836: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report...

CVE-2025-3444: Unrestricted Upload of File with Dangerous Type

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion LFI in the Admin module, where help card content is loaded...

PT-2025-22503

Name of the Vulnerable Software and Affected Versions fc-stable-diffusion-plus version 1.0.18 Description The issue is related to insecure permissions, which can allow attackers to escalate privileges and compromise the customer cloud account. Recommendations For fc-stable-diffusion-plus version...

PT-2025-22455 · Zohocorp · Manageengine Servicedesk Plus +1

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 Description: The issue concerns an authenticated Local File Inclusion LFI in the Admin module of the software, specifically where help card content is...

Sandboxie security vulnerabilities

Sandboxie is sandboxie-plus open source sandbox-based isolation software. A security vulnerability exists in Sandboxie versions prior to 0.0.1 through 1.15.12, which stems from an arithmetic overflow in the memory allocation subsystem that could result in a buffer overflow...

ZOHO ManageEngine ServiceDesk Plus security vulnerabilities

ZOHO ManageEngine ServiceDesk Plus is a set of IT service management software based on ITIL architecture from ZOHO. The software integrates Incident Management, Problem Management, Asset Management IT Project Management, Procurement and Contract Management modules. A security vulnerability exists...

ZOHO ManageEngine ADAudit Plus security vulnerabilities

ZOHO ManageEngine ADAudit Plus is used by ZOHO USA to simplify auditing, prove compliance and detect threats. A security vulnerability exists in ZOHO ManageEngine ADAudit Plus 8510 and prior versions that originates from SQL injection after authentication...

CVE-2025-45468

Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account...

CVE-2025-45468

The open-source tool fc-stable-diffusion (and specifically fc-stable-diffusion-plus version 1.0.18 ) is vulnerable to a privilege escalation flaw caused by incorrect permission assignment for critical resources. This vulnerability allows an attacker to escalate privileges and potentially compromi...

CVE-2025-45468

Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account...

CVE-2005-3285

Cross-site scripting XSS vulnerability in comersusbackofficesearchItemForm.asp in Comersus BackOffice Plus allows remote attackers to inject arbitrary web script or HTML via the 1 forwardTo1, 2 forwardTo2, 3 nameFT1, or 4 nameFT2 parameters...

CVE-2008-5417

HP DECnet-Plus 8.3 before ECO03 for OpenVMS on the Alpha platform uses world-writable permissions for the OSIT$NAMES logical name table, which allows local users to bypass intended access restrictions and modify this table via the 1 SYS$CRELNM and 2 SYS$DELLNM system services...

CVE-2006-7001

Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the L parameter, a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2005-2692

Multiple SQL injection vulnerabilities in RunCMS 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 addquery and 2 subquery parameters to the newbb plus module, the forum parameter to 3 newtopic.php, 4 edit.php, or 5 reply.php in the newbb plus module, or 6 the msg...

CVE-2008-1432

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location

The nsbackup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. This allows an unauthenticated remote user to download created backups and configuration files...

GHSA-HQ4F-5QJV-FWRG The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location

The nsbackup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. This allows an unauthenticated remote user to download created backups and configuration files...