4016 matches found
CVE-2025-29410
A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...
iBanking 安全漏洞
iBanking is an information system by Martin Mbithi Personal Developer. A security vulnerability exists in iBanking version v2.0.0, which stems from an arbitrary file upload vulnerability in the Client Profile Update section that could lead to the execution of arbitrary code...
H2O Vulnerable to Arbitrary File Overwrite
In h2oai/h2o-3 version 3.46.0, the /99/Models/name/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for...
WordPress Eventin plugin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion vulnerability
Authenticated Contributor+ Local File Inclusion vulnerability discovered by wesley wcraft in WordPress Plugin Eventin versions = 4.0.24...
SourceCodester Vehicle Management System 代码注入漏洞
SourceCodester Vehicle Management System is an open source vehicle management system from SourceCodester. A code injection vulnerability exists in SourceCodester Vehicle Management System version 1.0, which stems from incorrect manipulation of the parameter id that can lead to cross-site scriptin...
WordPress Tripetto plugin <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Tim Coen in WordPress Plugin WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto versions = 8.0.9...
GHSA-VHV4-FH94-JM5X JS Html Sanitizer allows XSS when used with contentEditable
Impact XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. Patches Patched in version 2.0.3...
WordPress WP Hide Admin Bar plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Hide Admin Bar versions = 2.0...
CVE-2025-28894 WordPress List of Posts from each Category plugin for WordPress plugin <= 2.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through = 2.0...
CVE-2025-27396
A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit the elevation of privileges required to perform certain valid functionality. This could allow an authenticated lowly-privileged remote attacker to escalate their...
CVE-2025-27393
A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...
WordPress plugin Back To Top 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in...
springboot-manager 代码注入漏洞
springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by an individual developer in China, liwenbin. A code injection vulnerability exists in springboot-manager version 3.0, which originates from cross-site scripting and...
CVE-2025-25747
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint...
WordPress plugin WP Hide Admin Bar 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
Arctera InfoScale 代码问题漏洞
Arctera InfoScale is a high-availability shared cloud storage solution from Arctera, Inc. that is designed to keep applications running in the event of an attack or outage. A security vulnerability exists in Arctera InfoScale versions 7.0 through 8.0.2 that stems from insecure deserialization cou...
CVE-2024-56196 Apache Traffic Server: ACL is not fully compatible with older versions
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue...
Apache Traffic Server 访问控制错误漏洞
Apache Traffic Server ATS is a suite of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. A security vulnerability exists in Apache Traffic Server versions 9.2.0 through 9.2.8 and 10.0.0 through 10.0.3 that stems from improper access control...
