9923 matches found
PT-2025-33206 · WordPress · Acato Wp Rest Cache
Name of the Vulnerable Software and Affected Versions: Acato WP REST Cache versions n/a through 2025.1.0 Description: Acato WP REST Cache is susceptible to a PHP Local File Inclusion due to an Improper Control of Filename for Include/Require Statement. This allows for the inclusion of local files...
WordPress plugin WP REST Cache 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...
com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0 <=9.5.0), org.apache.camel.springboot:camel-opensearch-starter (=4.12.0) +13 more potentially affected by CVE-2025-8885 via org.bouncycastle:bc-fips (=2.0.0)
org.bouncycastle:bc-fips MAVEN version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bc-fips and may be impacted: - com.itextpdf:bouncy-castle-fips-adapter =9.0.0, =3.22.0, =26.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0,...
JetBrains TeamCity 2023.11.4 - Authentication Bypass
!/usr/bin/env python3 -- coding: utf-8 -- """ Exploit Title: JetBrains TeamCity 2023.11.4 - Authentication Bypass Date: 2024-02-21 Exploit Author: ibrahimsql https://github.com/ibrahimsql Vendor Homepage: https://www.jetbrains.com/teamcity/ Version: =2.25.1 """ import requests import argparse...
The vulnerability of the REST API implementation of the monitoring and network equipment management system called Cisco Prime Infrastructure, as well as the Cisco Evolved Programmable Network Manager (EPNM) software for managing network services, allows a attacker to execute arbitrary code.
The vulnerability of the REST API interface of the Cisco Prime Infrastructure monitoring and network equipment management system, as well as the Cisco Evolved Programmable Network Manager EPNM, relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows...
WordPress AI Engine plugin code execution vulnerability
WordPress AI Engine plugin is a WordPress plugin that integrates artificial intelligence features, providing chatbots, content generation, image generation and other features, supporting docking with OpenAI and other platforms. WordPress AI Engine plugin has a code execution vulnerability that...
CVE-2025-51308
In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allowing him to collect some information, due to missing authorization checks...
PT-2025-32181 · Unknown · Gatling Enterprise
Name of the Vulnerable Software and Affected Versions: Gatling Enterprise versions prior to 1.25.0 Description: Gatling Enterprise is susceptible to an issue where a user with limited privileges, lacking the “admin” role, can execute REST API calls on read-only endpoints. This allows unauthorized...
CVE-2025-51308
In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allowing him to collect some information, due to missing authorization checks...
CVE-2025-52892 EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes e.g https://domain//Admin and the webserver does not strip the double slash, it can cause ...
CVE-2025-54554
tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure...
CVE-2025-7847
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restsimpleFileUpload function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...
MAL-2025-6669 Malicious code in wild-pet-rest-api (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in thoughtspot-rest-api-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-6601 Malicious code in thoughtspot-rest-api-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=-...
CVE-2025-7847
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restsimpleFileUpload function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...
WordPress plugin AI Engine 代码问题漏洞
WordPress AI Engine plugin is a WordPress plugin that integrates artificial intelligence features, providing chatbots, content generation, image generation and other features, supporting docking with OpenAI and other platforms. WordPress AI Engine plugin has a code execution vulnerability that...
PT-2025-31474 · WordPress · Ai Engine Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: AI Engine plugin for WordPress versions 2.9.3 and 2.9.4 Description: The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest simpleFileUpload function. This allows authenticat...
📄 XWiki 14 SQL Injection
XWiki version 14 suffers from a remote blind SQL injection vulnerability in getdeleteddocuments.vm. Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm Google Dork: N/A Date: 28 July 2025 Exploit Author: Byte Reaper LinkedIn: N/A Vendor Homepage: https://www.xwiki.org Software Link...
