CVE-2025-8356 Path Traversal leading to RCE

In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution RCE, allowing the attacker to run arbitrary commands on the system...

Mitel多款产品 安全漏洞

Mitel 6800 Series and Mitel 6900 Series are both a series of phones from Mitel Canada. A security vulnerability exists in various Mitel products that stems from insufficient parameter cleanup and could lead to a command injection attack. The following products and versions are affected: Mitel 680...

PT-2025-32172 · Electrolink · Electrolink Fm/Dab/Tv Transmitter Web Management System +1

Name of the Vulnerable Software and Affected Versions: Electrolink FM/DAB/TV Transmitter Web Management System versions 01.07, 01.08, and 01.09 Electrolink Display version 1.2 Electrolink Display version 1.4 Description: The Electrolink FM/DAB/TV Transmitter Web Management System is susceptible t...

IBM Db2 Mirror for i 授权问题漏洞

IBM Db2 Mirror for i is a software from International Business Machines IBM that ensures high availability, data consistency and disaster recovery for critical database systems. An authorization issue vulnerability exists in IBM Db2 Mirror for i version 7.4 and versions 7.5 and 7.6, which stems...

CVE-2025-3631

An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it...

Nimesa Backup and Recovery 操作系统命令注入漏洞

Nimesa Backup and Recovery is a data backup and recovery software from Nimesa India. An operating system command injection vulnerability exists in Nimesa Backup and Recovery version v2.3 and v2.4, which stems from the presence of an OS command injection vulnerability that could lead to the...

📄 Moodle 4.4.0 Remote Code Execution

Moodle version 4.4.0 authenticated remote code execution exploit. Exploit Title: Moodle 4.4.0 - Authenticated Remote Code Execution Exploit Author: Likhith Appalaneni Vendor Homepage: https://moodle.org Software Link: https://github.com/moodle/moodle/releases/tag/v4.4.0 Tested Version: Moodle 4.4...

VulnCheck KEV: CVE-2025-34046

An unauthenticated file upload vulnerability exists in the Fanwei E-Office = v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters uploadType=eofficelogo or...

CVE-2025-49975 WordPress JobWP plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hossni Mubarak JobWP allows Cross Site Request Forgery. This issue affects JobWP: from n/a through 2.4.0...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A flaw was discovered in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range multiple times in a single HTTP request, causing the server to use large amounts of memory. This does not resul...

GHSA-WJW6-95H5-4JPX Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Impact What kind of vulnerability is it? Who is impacted? All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot: 1. A malicious...

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme = 2.4 - Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme BodyCenter - Gym, Fitness WooCommerce WordPress Theme versions = 2.4...

WordPress plugin Valen 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

VulnCheck KEV: CVE-2018-2392

Under certain conditions SAP Internet Graphics Server IGS 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server IGS to become unavailable...

CVE-2025-30956

Cross-Site Request Forgery CSRF vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This issue affects Booqable Rental: from n/a through = 2.4.25...

CVE-2025-30956 WordPress Booqable Rental plugin <= 2.4.25 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This issue affects Booqable Rental: from n/a through = 2.4.25...

WordPress plugin Bacon Ipsum 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

juzaweb CMS allows cross-site scripting by uploading an SVG file

A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/file-manager/upload of the component Profile Page. The manipulation of the argument Upload leads to cross site scripting. The attack can...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS and Apple iPadOS prior to version 18.4, which arises from...

CVE-2025-5167

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The...