17362 matches found
CVE-2025-62709
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...
CVE-2025-63807
An issue was discovered in weijiang1994 university-bbs aka Blogin in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 2025-01-13. A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without...
CVE-2025-12751
The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetsettings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2025-12814
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseoresetsettings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted acce...
EUVD-2025-198338
An issue was discovered in weijiang1994 university-bbs aka Blogin in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 2025-01-13. A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without...
CVE-2025-63807
An issue was discovered in weijiang1994 university-bbs aka Blogin in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 2025-01-13. A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without...
CVE-2025-48986
The CVE-2025-48986 vulnerability affects Revive Adserver up to 6.0.1 (and 5.5.2 and earlier). An authenticated attacker can exploit an authorization bypass via the admin endpoint /admin/agency-user.php to change other users’ email addresses, enabling potential account takeover through the forgot-...
CVE-2025-62709
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...
CVE-2025-62709
ClipBucket v5.5.2 is vulnerable to password reset link manipulation due to a code change in network.class.php that builds the server URL from the HTTP Host header when base_url is not configured. Because Host is user-controlled, an attacker can supply an arbitrary Host value, causing forget.php p...
EUVD-2025-198296
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...
CVE-2025-62709 ClipBucket v5 is vulnerable to password reset link manipulation
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...
CVE-2025-62709 ClipBucket v5 is vulnerable to password reset link manipulation
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...
CVE-2025-62709 ClipBucket v5 is vulnerable to password reset link manipulation
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...
Complaint Management System reset-password.php File SQL Injection Vulnerability
Complaint Management System is a complaint management system. Complaint Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the email and mobileno parameters of reset-password.php. An attacker can exploit this...
PT-2025-47629
Name of the Vulnerable Software and Affected Versions weijiang1994 university-bbs aka Blogin versions prior to commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 2025-01-13 Description The software contains a flaw due to a weak verification code generation mechanism and a lack of rate limiting. This...
TencentOS Server 4: etcd (TSSA-2025:0331)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0331 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
PT-2025-47603
Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.2162 Description ClipBucket is a video sharing platform. A flaw in version 5.5.2 allows an attacker to control the server URL due to a dynamic build from the HTTP Host header when the base url configuration is...
CVE-2025-63807
An issue was discovered in weijiang1994 university-bbs aka Blogin in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 2025-01-13. A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without...
CVE-2025-63807
An issue was discovered in weijiang1994 university-bbs aka Blogin in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 2025-01-13. A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without...
CVE-2025-63807
CVE-2025-63807 affects the weijiang1994 university-bbs (aka Blogin). The weakness is a weak verification code generation mechanism together with missing rate limiting, enabling brute-force attempts on verification codes without authentication. Successful exploitation may lead to account takeover ...