PT-2025-38794

Name of the Vulnerable Software and Affected Versions Skimlinks versions through 1.3 Description A missing authorization issue exists in the Skimlinks Affiliate Marketing Tool. The issue allows access to functionality that is not properly constrained by Access Control Lists ACLs. Recommendations...

CVE-2025-10766 SeriaWei ZKEACMS EventViewerController.cs Download path traversal

A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipulation of the argument ID can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to t...

ZKEACMS 路径遍历漏洞

ZKEACMS is a visually designed, WYSIWYG content management system from ZKEASOFT open source. A path traversal vulnerability exists in ZKEACMS 4.3 and earlier versions, which stems from a mishandling of the parameter ID of the function Download in the file EventViewerController.cs, which could lea...

SUSE CVE-2025-58158

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server Gitness exposes api to retrieve and upload files via git LFS. Implementation ...

WordPress WP Hotel Booking plugin < 2.2.3 - Subscriber+ Rating Manipulation vulnerability

Subscriber+ Rating Manipulation vulnerability discovered by Muhammed Çelik in WordPress Plugin WP Hotel Booking versions 2.2.3...

CVE-2025-59424 LinkAce Vulnerable to Stored XSS on the Audit Page

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...

CVE-2025-58174

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script for example a script element. An...

Linux Distros Unpatched Vulnerability : CVE-2025-58174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile...

CVE-2025-58174 LAM profile editor stored cross-site scripting vulnerability

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script for example a script element. An...

LDAP Account Manager 跨站脚本漏洞

LDAP Account Manager LAM is a web front-end to the LDAP Account Manager open source for managing entries e.g., users, groups, DHCP settings stored in the LDAP directory. A cross-site scripting vulnerability exists in LDAP Account Manager LAM versions prior to 9.3, which stems from a profile name...

CVE-2025-7826

The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

mysql: Optimizer unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MyS...

WordPress plugin Analytics Reduce Bounce Rate 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-22956

OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductPropertyState contains a secret only intended to be accessible by a subset of clients. One example of this is a domain join account passwor...

Linux Distros Unpatched Vulnerability : CVE-2020-18778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Libav 12.3, there is a heap-based buffer over-read in vc1decodepmbintfi in vc1block.c that allows an attacker to cause denial-of-service via a crafted file...

Linux Distros Unpatched Vulnerability : CVE-2018-19128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Libav 12.3, there is a heap-based buffer over-read in decodeframe in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi...

PT-2025-37017

Name of the Vulnerable Software and Affected Versions: Testimonial plugin for WordPress versions prior to 2.3 Description: The Testimonial plugin for WordPress is susceptible to SQL Injection via the iNICtestimonial shortcode. This is due to insufficient escaping on the user-supplied parameter an...

ISC Stork 安全漏洞

ISC Stork is a web management platform for the ISC organization. A security vulnerability exists in ISC Stork version 2.3.0 and earlier, which stems from a large amount of data sent by an unauthenticated user could lead to memory and disk usage issues...

Linux Distros Unpatched Vulnerability : CVE-2020-29657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In JerryScript 2.3.0, there is an out-of-bounds read in mainprintunhandledexception in the main-utils.c file. CVE-2020-29657 Note that Nessus relies on the...

PT-2025-36683

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 All versions SIMATIC PCS neo versions 5.0 All versions User Management Component UMC versions prior to 2.15.1.3 Description: The software contains an out-of-bounds read issue in the integrated User Management...