17029 matches found
PT-2025-22913 · Llisoft · Llisoft Mta Maita Training System
Name of the Vulnerable Software and Affected Versions: llisoft MTA Maita Training System version 4.5 Description: A critical issue has been found in the this.fileService.download function of the file comllisoftcontrollerOpenController.java. The manipulation of the url argument leads to unrestrict...
CVE-2025-47618
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Reflected XSS.This issue affects BMI Adult & Kid Calculator: from n/a through = 1.2.2...
PT-2025-22870 · H3C · H3C Seccenter Smp-E1114P02
Name of the Vulnerable Software and Affected Versions: H3C SecCenter SMP-E1114P02 up to 20250513 Description: A vulnerability was found in the function downloadSoftware of the file /cfgFile/downloadSoftware. The manipulation of the argument filename leads to path traversal. The attack can be...
MAL-2025-4549 Malicious code in @stepstone-genesis/components (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5874a7aeef3ac8f8faaa8e232c3010de7fd69fe6e411681099034bbb0c712d5 Any computer that has this package installed or running should be considered...
CVE-2025-46714
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to 1.15.12, APIGETSECUREPARAM has an arithmetic overflow leading to a small memory allocation and then a extremely large copy into the small allocation...
CVE-2025-48376 Dnn.Platform's Site Import could use an external source with a crafted request
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser Host could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue...
GO-2025-3703 Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg
Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg...
GO-2025-3702 Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env
Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env...
GO-2025-3691 Mattermost Fails to Verify User's Permissions When Accessing Groups in github.com/mattermost/mattermost-server
Mattermost Fails to Verify User's Permissions When Accessing Groups in github.com/mattermost/mattermost-server...
GO-2025-3696 Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener
Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener...
CVE-2025-32285
CVE-2025-32285: WordPress Butcher theme (Butcher) vulnerability up to version 2.40 enabling Reflected XSS due to improper input neutralization during web page generation. Public details confirm affected software and vulnerability class; no exploitation status is provided in the documents. Patch i...
CVE-2025-47478
CVE-2025-47478 affects WordPress ProfileGrid (Metagauss ProfileGrid) with an SQL Injection due to improper neutralization of input. Affected versions are ProfileGrid 5.9.5.0 and earlier. The base metrics indicate high risk (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L; Base score 8.5). The CVE h...
CVE-2025-47671
CVE-2025-47671 : WordPress Binary MLM Plan plugin
CVE-2025-21609
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint. An attacker can craft a payload to exploit this vulnerability,...
CVE-2025-24701
Server-Side Request Forgery SSRF vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through = 1.3.2.9...
CVE-2025-24713
Cross-Site Request Forgery CSRF vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through = 3.1.1...
CVE-2024-52783
Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via modification of the configuration file...
CVE-2024-34458
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...
CVE-2024-1569
parisneo/lollms-webui is vulnerable to a denial of service DoS attack due to uncontrolled resource consumption. Attackers can exploit the /opencodeinvscode and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the...