54 matches found
The vulnerability of proxy servers with advanced web content filtering functions like Privoxy arises from insufficient validation of input data, allowing attackers to trigger service interruptions.
The vulnerability of a proxy server with extended content filtering functions, such as Privoxy, is related to insufficient validation of input data in the sendhttprequest function. Exploiting this vulnerability can allow an attacker to cause service interruptions...
EUVD-2007-1660
Malware in sbrugna...
CVE-2025-52039
In Frappe ERPNext 15.57.5, the function getmaterialrequestsbasedonsupplier at erpnext/stock/doctype/materialrequest/materialrequest.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter...
CVE-2025-10137
The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be...
CVE-2025-10137: Server-Side Request Forgery (SSRF)
The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be...
DEBIAN-CVE-2025-39785
In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix irqrequest's irq name variable is local The local variable is passed in requestirq , and there will be use after free problem, which will make requestirq failed. Using the global irq name instead of it to...
CVE-2025-8678 WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery
The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wpremoterequest' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations...
CVE-2025-8678
The CVE-2025-8678 entry concerns the WordPress WP Crontrol plugin. Affected versions 1.17.0–1.19.1 expose a blind Server-Side Request Forgery via wp_remote_request() that can be exploited by authenticated administrators or higher to issue web requests from the WordPress host to arbitrary external...
OliveTin OS Command Injection vulnerability
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
CVE-2025-50946
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
PT-2025-20299
Name of the Vulnerable Software and Affected Versions q2apro q2apro-on-site-notifications versions up to 1.4.6 Description A problematic issue was found, affecting the process request function of the file q2apro-onsitenotifications-page.php. This leads to cross-site scripting and can be initiated...
CVE-2025-31490
CVE-2025-31490 affects AutoGPT prior to 0.6.1 and is caused by a DNS rebinding flaw in the requests wrapper used to validate hostnames. The wrapper, located at autogpt_platform/backend/backend/util/request.py, attempts to prevent SSRF by rejecting local IPv4/IPv6 resolutions, but a DNS server’s T...
PT-2025-6534 · WordPress · Wp Directorybox Manager
Name of the Vulnerable Software and Affected Versions: WP Directorybox Manager plugin for WordPress versions up to, and including, 2.5 Description: The issue is due to incorrect authentication in the wp dp parse request function, allowing unauthenticated attackers to log in as any existing user o...
The vulnerability of the Linux operating system’s kernel USB component, which allows a hacker to trigger a service failure
The vulnerability of the Linux operating system’s kernel USB component is related to errors in resource management in the plvendorreq function. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2024-6122 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: InPost for WooCommerce plugin versions 1.4.0 and earlier InPost PL plugin for WordPress versions 1.4.4 and earlier Description: The issue is related to a missing capability check on the parse request function, allowing unauthorized access and...
Prototype Pollution
@cafebazaar/hod is vulnerable to Prototype Pollution. The vulnerability is due to missing checks in the request function, allowing attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
hod security breach
hod is an open source library from Cafe Bazaar. A security vulnerability exists in hod version v0.4.14, which originates from the inclusion of prototype contamination via the function request, allowing an attacker to execute arbitrary code or cause a denial of service DoS by injecting arbitrary...
CVE-2024-39015: Improper Control of Generation of Code
cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
PT-2024-28325 · Unknown · Cafebazaar Hod
Name of the Vulnerable Software and Affected Versions: cafebazaar hod version 0.4.14 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through a prototype pollution vulnerability in the request function...
