CVE-2025-21611 tgstation-server's role authorization incorrectly OR'd with user's enabled status

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions...

PT-2025-3002 · Unknown · Com.Callos14.Callscreen.Colorphone

Name of the Vulnerable Software and Affected Versions: com.callos14.callscreen.colorphone also known as iCall OS17 - Color Phone Flash versions 4.3 and earlier Description: The issue allows any application to place phone calls without user interaction by sending a crafted intent via the...

WordPress plugin Embed PDF Viewer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. WordPress plugin Embed PDF Viewer...

iXsystems TrueNAS CORE 路径遍历漏洞

iXsystems TrueNAS CORE is an open source storage software from iXsystems. A path traversal vulnerability exists in iXsystems TrueNAS CORE version 13.3-RELEASE, which stems from a lack of proper validation of user-supplied paths in the tarfile.extractall method, which could lead to directory...

CVE-2024-39025

Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data...

PT-2025-3275 · One Identity · One Identity Identity Manager

Name of the Vulnerable Software and Affected Versions: One Identity Identity Manager versions prior to 9.3 Description: An insecure direct object reference IDOR issue allows privilege escalation. Only On-Premise installations are affected. The vulnerability can be exploited by a remote attacker t...

HPESBST04766 rev.1 - HPE B-Series SANnav Management Portal, Remote Authentication Bypass Vulnerability

Potential Security Impact: Remote: Authentication Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SANnav Management Software - Prior to v2.3.0a CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2023-52160 |...

WordPress plugin Download Manager 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...

CVE-2024-54292

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through = 2.1.3...

PT-2024-36184 · Unknown · Yalla Ya! Simple Payment

Name of the Vulnerable Software and Affected Versions: yalla ya! Simple Payment versions 2.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can...

djoser 安全漏洞

djoser is a REST implementation of the Django authentication system open-sourced by Sunscrapers. A security vulnerability exists in djoser versions prior to 2.3.0, which stems from the system directly querying the database to grant access to users with valid credentials, making it susceptible to ...

PT-2024-16986 · WordPress · Sql Chart Builder

Name of the Vulnerable Software and Affected Versions: SQL Chart Builder plugin for WordPress versions up to, and including, 2.3.6 Description: The issue arises from insufficient escaping on the user-supplied arg1 parameter and lack of sufficient preparation on the existing SQL query in the gvn...

CVE-2023-30479

Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce stampedio-product-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through = 2.3.2...

WordPress plugin FloristPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Team Member 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in WordPres...

CVE-2024-5288

...

WordPress Stars Testimonials plugin <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Peter Thaleikis in WordPress Plugin Stars Testimonials versions = 3.3.3...

HoDoKu 安全漏洞

HoDoKu is HoDoKu open source a Sudoku generator/solver/analyzer written in Java. A security vulnerability exists in HoDoKu versions v2.3.0 through v2.3.2, which stems from the presence of insecure deserialization that allows an attacker to execute arbitrary code...

SFTPGo 加密问题漏洞

SFTPGo is a full-featured and highly configurable SFTP server from the individual developer Nicola Murino in Italy. An encryption issue vulnerability exists in SFTPGo versions 2.3.0 through prior to 2.6.4, which stems from a vulnerability that allows an authenticated user to brute-force break a...

Zulip 安全漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in Zulip version 8.3 that stems from vulnerability to cross-site scripting XSS attacks...