EUVD-2015-2947

Malware in sbrugna...

EUVD-2023-3134

Malicious code in bioql PyPI...

EUVD-2021-8804

Malicious code in bioql PyPI...

EUVD-2024-22426

Malicious code in bioql PyPI...

EUVD-2024-38231

Malicious code in bioql PyPI...

EUVD-2025-13046

Malicious code in bioql PyPI...

Horilla 代码问题漏洞

Horilla is a free and open source HR software from Horilla Inc. A code issue vulnerability exists in Horilla versions prior to 1.4.0 that stems from a file upload process that performs only browser-side validation without implementing server-side checks, which could lead to stored cross-site...

CVE-2025-8942 WP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

CVE-2025-0309

An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to...

CVE-2025-6025 Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts

The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the data-tip attribute, which makes it possible for unauthenticated attackers to apply an...

CVE-2025-0309 Netskope Client Local Elevation of Privileges

An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to...

CVE-2025-0309

CVE-2025-0309 describes a local privilege escalation in Netskope Client for Windows due to insufficient validation on the server connection endpoint. An attacker-controlled server using publicly signed TLS certificates can cause the client to send specially crafted responses, enabling privilege e...

CVE-2025-8661

A stored Cross-Site Scripting vulnerability XSS occurs when the server does not properly validate or encode the data entered by the user...

CVE-2025-8661

A stored Cross-Site Scripting vulnerability XSS occurs when the server does not properly validate or encode the data entered by the user...

CVE-2025-20332

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this...

CVE-2025-50849

CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference IDOR. The user profile functionality allows enabling or disabling stickers through a parameter companyid sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate...

CVE-2025-53545

The CVE-2025-53545 entry concerns Press, a Frappe custom app used with Frappe Cloud. The underlying issue is a lack of server-side validation that allows bypassing two-factor authentication (2FA) for users. The vulnerability description confirms that this is a 2FA bypass resulting from insufficie...

CVE-2025-53545 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

Astra Linux – Vulnerability in libsoup3

A flaw was discovered in libsoup. The HTTP/2 server in libsoup may not fully validate the values of the pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a Denial of Service DoS attack...

ROS-20250616-07

A vulnerability in the Mbed TLS software is related to a bug in the handling of memory allocation during the during the TLS handshake. Exploitation of the vulnerability could allow an attacker to bypass the authentication process Mbed TLS software vulnerability is related to insecure default...