CVE-2025-4375 Cross-Site Request Forgery vulnerability in Pro Cloud Server's WebEA

Cross-Site Request Forgery CSRF vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affec...

CVE-2025-4375 Cross-Site Request Forgery vulnerability in Pro Cloud Server's WebEA

Cross-Site Request Forgery CSRF vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affec...

📄 Microsoft Windows 11 Pro 23H2 Privilege Escalation

Microsoft Windows version 11 Pro 23H2 Ancillary Function Driver for WinSock privilege escalation exploit. Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Elevation of Privilege Date: 2025-05-05 Exploit Author: Milad Karimi Ex3ptionaL Contact:...

PT-2025-20473 · Sparx Systems · Sparx Systems Pro Cloud Server

Name of the Vulnerable Software and Affected Versions: Sparx Systems Pro Cloud Server versions earlier than 6.0.165 Description: A Cross-Site Request Forgery CSRF issue is present in the whole application, allowing for Session Hijacking. This issue can be used to change the Pro Cloud Server...

Sparx Systems Pro Cloud Server 安全漏洞

Sparx Systems Pro Cloud Server is an enterprise-class model collaboration platform from Sparx Systems Australia that supports cloud sharing and version control of EA Enterprise Architect models. A security vulnerability exists in Sparx Systems Pro Cloud Server versions prior to 6.0.165, which ste...

Sparx Systems Pro Cloud Server 安全漏洞

Sparx Systems Pro Cloud Server is an enterprise-class model collaboration platform from Sparx Systems Australia that supports cloud sharing and version control of EA Enterprise Architect models. A security vulnerability exists in Sparx Systems Pro Cloud Server versions prior to 6.0.165, which ste...

Sparx Systems Pro Cloud Server 安全漏洞

Sparx Systems Pro Cloud Server is an enterprise-class model collaboration platform from Sparx Systems Australia that supports cloud sharing and version control of EA Enterprise Architect models. A security vulnerability exists in Sparx Systems Pro Cloud Server versions prior to 6.0.165, which ste...

PT-2025-20475 · Sparx Systems · Sparx Systems Pro Cloud Server

Name of the Vulnerable Software and Affected Versions: Sparx Systems Pro Cloud Server versions earlier than 6.0.165 Description: The issue is caused by an Improper Limitation of a Pathname, leading to a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present ...

PT-2025-20474 · Sparx Systems · Sparx Systems Pro Cloud Server

Name of the Vulnerable Software and Affected Versions: Sparx Systems Pro Cloud Server versions earlier than 6.0.165 Description: The issue is related to an Improper Input Validation vulnerability in the WebEA model search field of Sparx Systems Pro Cloud Server, which allows Cross-Site Scripting...

Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation

Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation Date: 2025-05-05 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Tested on: Win x64 CVE : CVE-2024-38193 pragma once...

CVE-2025-47545

CVE-2025-47545 relates to a race condition in the WordPress plugin Poll Maker. Affected software: Poll Maker versions n/a through 5.7.7. Root cause per sources: Concurrent execution using a shared resource with improper synchronization. Documented impact aligns with race conditions (no concrete e...

The vulnerability of the CommuniGate Pro mail server, related to errors in eliminating special elements, allows a violator to execute arbitrary code.

The vulnerability of the CommuniGate Pro mail server is related to errors in eliminating special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices arises from the lack of measures taken to neutralize special elements used in the operating system’s command sequence. This allows attackers to execute arbitrary commands with elevated privileges.

The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...

PT-2025-20158 · Unknown · Ays Pro Poll Maker

Name of the Vulnerable Software and Affected Versions: Ays Pro Poll Maker versions n/a through 5.7.7 Description: The issue is related to a 'Race Condition' vulnerability, which occurs due to concurrent execution using shared resources with improper synchronization. This allows for leveraging rac...

CVE-2025-1909

The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for...

CVE-2025-1909

The CVE describes an authentication bypass in the WordPress BuddyBoss Platform Pro plugin (WordPress). Affected versions: up to and including 2.7.01. Root cause: insufficient verification on the user supplied during the Apple OAuth authentication request, allowing unauthenticated attackers to log...

CVE-2025-1909 BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider

The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for...

WordPress BuddyBoss Platform Pro plugin <= 2.7.01 - Authentication Bypass via Apple OAuth provider vulnerability

Authentication Bypass via Apple OAuth provider vulnerability discovered by István Márton in WordPress Plugin BuddyPress Platform Pro versions = 2.7.01...

WordPress plugin BuddyBoss Platform Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2025-4204

The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auctionid’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...