CVE-2024-47092 Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api

Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1...

picklescan security vulnerability

picklescan is a security scanning program by the individual developer Matthieu Maitre. A security vulnerability exists in versions of picklescan prior to 0.0.22, which stems from an improperly restricted scanning scope that could lead to malicious files bypassing security checks...

WordPress plugin Implied Cookie Consent has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

i-Drive i11 and i-Drive i12 security vulnerabilities

The i-Drive i11 and i-Drive i12 are both a car recorder from i-Drive, Inc. A security vulnerability exists in i-Drive i11 and i-Drive i12 20250227 and prior versions, which stems from improper access control and could lead to a remote attack...

zz Code Issues and Vulnerabilities

zz is an e-commerce platform for zj1983 individual developers. A code issue vulnerability exists in zz 2024-8 and prior versions, which stems from improper handling of the url parameter in the HTTP request handling component, leading to server-side request forgery...

ZZ injection vulnerability

zz is an e-commerce platform for zj1983 individual developers. An injection vulnerability exists in zz 2024-8 and prior versions, which stems from SQL injection and could lead to remote code execution...

SUSE CVE-2025-27154

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. This leads to overly...

CVE-2025-1746 Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

AZL-57501 CVE-2025-1744 affecting package ceph for versions less than 18.2.2-6

Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before 5.9.9...

SOTESHOP Cross-Site Scripting Vulnerabilities

SOTESHOP is an online store system from SOTESHOP Inc. A cross-site scripting vulnerability exists in SOTESHOP versions prior to 8.3.4. An attacker can exploit this vulnerability to remotely execute code...

PT-2025-9135 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions prior to 1.2.0 Description: The issue concerns the backup restore functionality, which allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template...

PT-2025-9078 · Blackmagic Design · Davinci Resolve

Name of the Vulnerable Software and Affected Versions: DaVinci Resolve versions prior to 19.1.3 Description: The issue is related to incorrect file permissions in DaVinci Resolve on MacOS, which can lead to Dylib Hijacking. This inconsistency with standard macOS security practices allows for...

PT-2025-9088 · WordPress · The Site Mailer – Smtp Replacement

Name of the Vulnerable Software and Affected Versions: The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress versions prior to 1.2.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping...

mongosh vulnerable to local privilege escalation

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\nodemodules. This issue affects mongosh prior to 2.3.0...

CVE-2024-51539

The Dell Secure Connect Gateway SCG Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to improper neutralization of special elements used in an SQL command. This vulnerability can only be exploited locally on the affected system. A high-privilege attack...

CVE-2025-1693

Summary: CVE-2025-1693 affects the MongoDB Shell (mongosh) prior to version 2.3.9. When mongosh is connected to a cluster that is partially or fully under an attacker’s control, an attacker can inject control characters into the shell output, potentially causing falsified messages that appear to ...

MongoDB Shell may be susceptible to control character injection via pasting

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue...

Viayoo Via Browser Code Injection Vulnerability

Viayoo Via Browser is a lightweight free Android web browser from Viayoo. A code injection vulnerability exists in Viayoo Via Browser version 5.9.0 and prior versions, which stems from improper handling of the Javascript Bridge component...

PT-2025-8947 · Unknown · Yukseloglu Filter B2B Login Platform

Name of the Vulnerable Software and Affected Versions: Yukseloglu Filter B2B Login Platform versions prior to 16.01.2025 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

CVE-2025-1692: Improper Neutralization of Escape, Meta, or Control Sequences

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue...