EUVD-2023-1770

Malicious code in bioql PyPI...

EUVD-2024-35857

Malicious code in bioql PyPI...

CVE-2025-6815

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘servicename’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-6815

CVE-2025-6815: LatePoint – Calendar Booking Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the service[name] parameter in all versions up to 5.1.94. Exploitation requires authenticated administrator access; the flaw arises from insufficient input sanitization and output esc...

CVE-2025-6815 LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘servicename’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2025-39954

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94 Description The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is susceptible to Stored Cross-Site Scripting. The issue stem...

CVE-2025-10771 jeecgboot JimuReport DB2 JDBC testConnection deserialization

A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack...

DEBIAN-CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

📄 Remote for Windows 2024.15 Unquoted Service Path

Remote for Windows version 2024.15 suffers from an unquoted service path vulnerability. Exploit Title: Remote for Windows 2024.15 - Unquoted Service Path Date: 2025-05-23 Exploit Author: Chokri Hammedi Vendor Homepage: https://rs.ltd Software Link: https://rs.ltd/latest.php?os=win Version: 2024.1...

CVE-2024-33043

Transient DOS while handling PS event when Program Service name length offset value is set to 255...

CVE-2025-45755

A Stored Cross-Site Scripting XSS vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improper...

Incorta 安全漏洞

Incorta is an enterprise-grade data analytics and business intelligence platform from Incorta USA that rapidly enables data insights and decision support. A security vulnerability exists in Incorta version 2023.4.3, which stems from improper handling of the Service Name parameter in the Edit...

CVE-2024-36053

In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in checkconnection, dropdatareceivedcb, and Service.remove. A user can modify a service name in a /.linuxmint/mintUpload/services/service file...

CVE-2021-3671

...

CVE-2024-33043 Buffer Over-read in FM Host

Transient DOS while handling PS event when Program Service name length offset value is set to 255...

CVE-2024-33043 Buffer Over-read in FM Host

Transient DOS while handling PS event when Program Service name length offset value is set to 255...

Azure CLI Credentials Gatherer

This module will collect the Azure CLI 2.0+ az cli settings files for all users on a given target. These configuration files contain JWT tokens used to authenticate users and other subscription information. Once tokens are stolen from one host, they can be used to impersonate the user from a...

CVE-2024-36053

In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in checkconnection, dropdatareceivedcb, and Service.remove. A user can modify a service name in a /.linuxmint/mintUpload/services/service file...

CVE-2024-36053

CVE-2024-36053 affects the Linux Mint mintupload package up to version 4.2.0, where a service-name mishandling allows command injection via shell metacharacters in functions check_connection, drop_data_received_cb, and Service.remove. An attacker can modify a service name in ~/.linuxmint/mintUplo...

mintupload 安全漏洞

mintupload is an open source library for Linux Mint. A security vulnerability exists in mintupload version 4.2.0 and earlier, which stems from mishandling of service names, which allows a user to modify the name of a service in a file...