Selleo Mentingo 代码问题漏洞

Selleo Mentingo is an in-house training and employee development platform from Selleo Poland. A code issue vulnerability exists in Selleo Mentingo version 2025.08.27, which stems from an insufficient restriction of the parameter userAvatar in the Content-Type Handler component, which could lead t...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the gRPC API and HTTP APIs, which allow peers to send requests that cause the recipient to create files in arbitrary file system locations and read arbitrary files. An attacker can access sensitive data or execu...

CVE-2025-10615 itsourcecode E-Commerce Website products.php unrestricted upload

A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2025-59352

Dragonfly CVE-2025-59352 affects the Dragonfly open source P2P file distribution and image acceleration system. Prior to version 2.1.0, the gRPC API and HTTP APIs allow peers to request actions that force the recipient to create files in arbitrary filesystem locations and to read arbitrary files,...

itsourcecode E-Commerce Website 代码问题漏洞

itsourcecode E-Commerce Website is an e-commerce website by itsourcecode open source. A code issue vulnerability exists in version 1.0 of itsourcecode E-Commerce Website, which stems from an incorrect operation of the file /admin/products.php, which could lead to remote arbitrary file uploads...

CVE-2025-34185

Ilevia EVE X1 Server prior to 4.7.18.0.eden is affected by CVE-2025-34185, a pre-authentication file disclosure via the db_log POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials. This is an unauthenticated disclosur...

PT-2025-38075

Name of the Vulnerable Software and Affected Versions: Ilevia EVE X1 Server versions prior to 4.7.18.0.eden Description: Ilevia EVE X1 Server versions prior to 4.7.18.0.eden contain a pre-authentication file disclosure issue via the db log POST parameter. Remote attackers can retrieve arbitrary...

JustTryHarder

This is a cheat sheet repository for the PWK Pentester's Workbench course and the OSCP Offensive Security Certified Professional exam. It is inspired by PayloadAllTheThings. The repository contains various tools, scripts, and resources for penetration testing and exploitation. The repository...

fimap

fimap is a Python tool designed to find, prepare, audit, exploit, and even automatically Google for local and remote file inclusion LFI/RFI bugs in web applications. It can identify and exploit file inclusion bugs, including include, includeonce, require, and requireonce functions. The tool has a...

CVE-2025-47695

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through = 3.4.7...

CVE-2025-47571

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through 7.8...

Linux Distros Unpatched Vulnerability : CVE-2012-6531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 1 ZendDom, 2 ZendFeed, and 3 ZendSoap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow...

Linux Distros Unpatched Vulnerability : CVE-2015-1155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same...

Linux Distros Unpatched Vulnerability : CVE-2011-0167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upload of arbitrary loc...

CVE-2025-58215

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through 1.4.5...

CVE-2025-54709

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6...

CVE-2025-47695

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through = 3.4.7...

CVE-2025-47571

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through 7.8...

CVE-2025-54709

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Sala sala.This issue affects Sala: from n/a through = 1.1.6...

CVE-2025-54709 WordPress Sala Theme <= 1.1.6 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Sala sala.This issue affects Sala: from n/a through = 1.1.6...