Dmacroweb DM Corporative CMS Insecure Direct Elephant Reference Vulnerability (CNVD-2025-14359)

Dmacroweb DM Corporative CMS is a content management system from the Spanish company Dmacroweb. Dmacroweb DM Corporative CMS suffers from an insecure direct object reference vulnerability, which stems from the failure of the option parameter in the file /administer/selectionnode/framesSelection.a...

Path Traversal Vulnerability in Various ABB Products (CNVD-2025-13774)

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

Astra Linux – Vulnerability in ansible-core

A flaw was discovered in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plain text during the execution of a playbook. This occurs when tasks such as includevars are used to load vaulted variables without setting the nolog: true parameter. As a result,...

CVE-2025-25264

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system...

CVE-2025-25264 Overly Permissive CORS Policy in WAGO Device Manager

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system...

CVE-2025-25264

CVE-2025-25264 describes an unauthenticated remote attack against WAGO Device Manager, where an attacker can trick an admin to visit a page containing malicious JavaScript. The root cause is an overly permissive CORS policy that allows access to files on the affected system, enabling potential di...

CVE-2025-25264 Overly Permissive CORS Policy in WAGO Device Manager

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system...

CVE-2025-4200

The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the loadview function that is called via at least three AJAX actions: 'loadmorepost', 'loadshop', and 'loadmoreproduct. This...

CVE-2025-5487

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the fieldconditions parameter in all versions up to, and including, 5.2.3 due to insufficient escaping on the user supplied...

The vulnerability of the “Termide Virtual Desktops Connection Manager” software server system, related to deficiencies in the testing mechanism for integrations, allows a hacker to disclose protected information.

The vulnerability of the “Termide Virtual Desktops Connection Manager” software suite is related to deficiencies in the testing mechanisms for integrations. Exploiting this vulnerability allows a malicious actor to disclose sensitive information...

TencentOS Server 3: gnutls (TSSA-2024:0055)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0055 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

WAGO Device Manager 安全漏洞

WAGO Device Manager is a device manager software from WAGO. A security vulnerability exists in WAGO Device Manager that stems from the current overly lax CORS policy and could lead to the disclosure of sensitive data...

The vulnerability of the IDE Assets component in the Xcode development environment allows a hacker to gain unauthorized access to protected information.

The vulnerability of the IDE Assets component in the Xcode development environment is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

TencentOS Server 4: openssl (TSSA-2024:0818)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0818 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Malicious code in browser-history-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 032a326beadf36ce66d29555a7dacc90d6dfc733435dc61852cbc1e5128ee73d When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

CVE-2025-49196

A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the device...

CVE-2025-6003

The WordPress Single Sign-On SSO plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the .5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data...

TOTOLINK T10 Buffer Overflow Vulnerability

The TOTOLINK T10 is a dual-band mesh networking router from TOTOLINK for full coverage needs of home and office networks. A buffer overflow vulnerability exists in TOTOLINK T10. The vulnerability stems from incorrect manipulation of the parameter desc in the file /cgi-bin/cstecgi.cgi. An attacker...

PT-2025-25539 · Wago +1 · Cc100 0751-9X01 +16

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An unauthenticated remote attacker can take advantage of the current overly permissive CORS policy to gain access and read the responses, potentially exposing sensitive data or enabling...

WordPress History Log by click5 Cross-Site Scripting Vulnerability

WordPress History Log by click5 is a plugin for tracking user activity and logging changes to your website. A cross-site scripting vulnerability exists in WordPress History Log by click5. The vulnerability stems from improper input neutralization and can be exploited by an attacker to execute...