Digiwin ERP 代码问题漏洞

Digiwin ERP is an e-commerce platform from China Dingxin Digiwin. A code issue vulnerability exists in Digiwin ERP version 5.0.1, which originates from an unrestricted upload and could lead to a remote attack...

CVE-2025-30347

Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects...

Jinher OA C6 安全漏洞

Jinher OA C6 is a digital office platform of China Jinhe Jinher Company. A security vulnerability exists in Jinher OA C6 version 1.0, which stems from improper manipulation of the httpOID parameter in the IncentivePlanFulfillAppprove.aspx file, which could lead to a SQL injection attack...

Improper Verification of Source of a Communication Channel

Overview Flask-Cors is an A Flask extension adding a decorator for CORS support Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel due to improper application of regex path matching rules. An attacker can gain unauthorized cross-origin...

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal enabling the deletion of files on the target server. An attacker can delete critical files such as polyaxon.sock to cause a crash of the API container. PoC python import requests url =...

CVE-2025-0190

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these...

CVE-2024-12866

CVE-2024-12866 affects netease-youdao/qanything v2.0.0. It is a local file inclusion (path traversal) vulnerability caused by an unvalidated file path to an access-restricted directory, enabling reading arbitrary files on the filesystem and potentially facilitating remote code execution via sensi...

CVE-2024-12866 Local File Inclusion in netease-youdao/qanything

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration...

CVE-2024-8101 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be...

CVE-2024-12778

CVE-2024-12778 affects the Aim project (aimhubio/aim) v3.25.0. The root cause is an absence of a limit on the number of metrics requested per call, which, together with a single-threaded server, allows excessive resource consumption and can render the web API unresponsive (DoS). Concretely, retri...

Xpdf 安全漏洞

Xpdf is a free PDF viewer and toolkit from Xpdf, Inc. that includes a text extractor, image converter, HTML converter, and more. A security vulnerability exists in Xpdf 4.05 and earlier versions, which stems from an integer overflow checking error in the PostScript function interpreter code,...

Audi Universal Traffic Recorder App 安全漏洞

The Audi Universal Traffic Recorder App is a special app for traffic recorders from Audi, which can be used to connect to a traffic recorder, view previews, lock videos, and other operations. A security vulnerability exists in the Audi Universal Traffic Recorder App version 2.0, which stems from...

CVE-2025-29410

A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...

iBanking 安全漏洞

iBanking is an information system by Martin Mbithi Personal Developer. A security vulnerability exists in iBanking version v2.0.0, which stems from an arbitrary file upload vulnerability in the Client Profile Update section that could lead to the execution of arbitrary code...

H2O Vulnerable to Arbitrary File Overwrite

In h2oai/h2o-3 version 3.46.0, the /99/Models/name/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for...

WordPress Eventin plugin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by wesley wcraft in WordPress Plugin Eventin versions = 4.0.24...

SourceCodester Vehicle Management System 代码注入漏洞

SourceCodester Vehicle Management System is an open source vehicle management system from SourceCodester. A code injection vulnerability exists in SourceCodester Vehicle Management System version 1.0, which stems from incorrect manipulation of the parameter id that can lead to cross-site scriptin...

PT-2026-7964

Name of the Vulnerable Software and Affected Versions Vnet/IP Interface Package versions R1.07.00 and earlier Description A flaw exists in the Vnet/IP Interface Package that could allow a denial-of-service DoS attack. Receiving maliciously crafted packets may cause Vnet/IP communication functions...

WordPress Tripetto plugin <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Tim Coen in WordPress Plugin WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto versions = 8.0.9...