EUVD-2024-1112

Malicious code in bioql PyPI...

EUVD-2024-18191

Malicious code in bioql PyPI...

CVE-2024-58260

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts...

CVE-2024-58260 Rancher update on users can deny the service to the admin

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts...

CVE-2025-8118

PAD CMS implements weak client-side brute-force protection by utilizing two cookies: logincount and logintimeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue...

CVE-2025-59524

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation for example, with an intercepting proxy or by...

CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation for example, with an intercepting proxy or by...

CVE-2025-8942

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

CVE-2025-8942

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

CVE-2025-8942

The WP Hotel Booking WordPress plugin, in versions prior to 2.2.3 , is vulnerable to a subscriber rating manipulation flaw. The root cause is a lack of proper server-side validation for review ratings, which allows an attacker to intercept and modify requests to submit negative or out-of-range va...

CVE-2025-8942 WP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

PT-2025-38300

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.2.3 Description The WP Hotel Booking WordPress plugin does not perform adequate server-side validation of review ratings. This allows an attacker to modify the rating value by intercepting...

CVE-2025-8942: Undefined Security Weakness

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

SALT.BOX SSRF

The vulnerability of the SALT.BOX software lies in insufficient testing of requests on the server side. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...

Adobe Experience Manager SSRF

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and perform an SSRF attack...

GLPI SSRF

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to carry out an SSRF attack...

GHSA-C7V7-RQFM-F44J Vaadin Platform possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

GHSA-94G8-XV23-7656 Vaadin Flow Components possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

GHSA-9GFH-4FWJ-W3RJ Vaadin Framework possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

Possibility to bypass file upload validation on the server-side

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. See CWE-20 Improper Input Validation Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is...