DiracX-Web input validation error vulnerability

DiracX-Web is an open source user interface for DiracX from the DIRAC Project. An input validation error vulnerability exists in versions of DiracX-Web prior to 0.1.0-a8, which stems from an unvalidated redirect field and could lead to a phishing attack...

CVE-2025-34118

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/',...

CVE-2025-34300

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands...

CVE-2025-7673

A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50ABOM.5C0 could allow an unauthenticated attacker to cause denial-of-service DoS conditions and potentially execute arbitrary code by sending a specially crafted HTTP...

WordPress plugin CM Pop-Up Banners has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Linknat VOS Manager security vulnerability

Linknat VOS Manager is a VOS web operating platform for mobile use by China Kunshi Network Linknat. A security vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, which stems from a path traversal attack that could result in reading arbitrary files on the server...

LILIN Digital Video Recorder security vulnerabilities

LILIN Digital Video Recorder is a video recorder from LILIN Taiwan, China. A security vulnerability exists in LILIN Digital Video Recorder versions prior to 2.0b6020200207, which originates from an arbitrary file read and could lead to the reading of sensitive configuration files...

CVE-2025-37106: Improper Authentication

An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server APLS prior to 9.18...

📄 Beakon Cross Site Scripting / Open Redirection

Beakon versions prior to 5.4.3 suffer from cross site scripting and open redirection vulnerabilities. I am submitting a news article for publishing my recent Zero day vulnerability. I have already contacted MITRE and have CVE-2025-46102 reserved now. Please find below details: Title: Unsensitized...

Microsoft Edge (Chromium) < 138.0.3351.95 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 138.0.3351.95. It is, therefore, affected by multiple vulnerabilities as referenced in the July 16, 2025 advisory. - Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to...

Zoom Workplace < 6.4.0 Vulnerability (ZSB-25028)

The version of Zoom Workplace installed on the remote host is prior to 6.4.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-25028 advisory. - Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via networ...

kkFileViewOfficeEdit Path Traversal Vulnerability

kkFileViewOfficeEdit is a file online preview and online editing software for OFFICE by YiJiuSmile personal developer. A path traversal vulnerability exists in kkFileViewOfficeEdit 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and prior versions, which stems from a path traversal vulnerability caused ...

Ivanti Desktop and Server Management security vulnerabilities

Ivanti Desktop and Server Management Ivanti DSM is a multi-platform, unified endpoint management solution from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Desktop and Server Management versions prior to 2024.2, which stems from a hard-coded key that could allow an...

CVE-2025-53519

A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting XSS attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or...

Osc Open OnDemand security vulnerability

Osc Open OnDemand is an application from the Osc open source organization in the United States. It provides a for accessing HPC services. A security vulnerability exists in Osc Open OnDemand versions prior to 3.1.14 and prior to 4.0.6 that stems from improper log handling and could lead to a deni...

WordPress plugin GeoDirectory has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

Broadcom Brocade SANnav security vulnerabilities

Broadcom Brocade SANnav is a storage area network management and automation software platform from Broadcom, Inc. A security vulnerability exists in Broadcom Brocade SANnav versions prior to 2.4.0a, which stems from logging plaintext password phrases in the logs...

PT-2025-32583

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0 Description: The Mattermost Confluence Plugin does not properly handle unexpected request bodies. This allows attackers to crash the plugin by repeatedly sending requests with invalid bodie...

PT-2025-28984 · WordPress · Hostel Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Hostel WordPress plugin versions prior to 1.1.5.9 Description: The Hostel WordPress plugin does not properly sanitize and escape certain settings. This could allow users with high privileges, such as administrators, to perform Stored Cross-Si...

CVE-2025-36599

Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be...