CVE-2025-7971

CVE-2025-7971 affects Rockwell Automation’s Studio 5000 Logix Designer. The issue arises from unsafe handling of environment variables, where a path without a valid file can cause the application to crash and, in some cases, may allow arbitrary code execution locally. The available connected sour...

CVE-2025-7971 Studio 5000 Logix Designer® – Arbitrary Code Execution Vulnerability

A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash...

CVE-2025-49036

CVE-2025-49036 is a Local File Inclusion vulnerability in WordPress Premium Addons for KingComposer (versions up to 1.1.1). The issue arises from improper control of filename handling for include/require statements in PHP, enabling an attacker to potentially include local files. No exploit vector...

Rockwell Automation Studio 5000 Logix Designer

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to crash the device or execute malicious code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

Security Updates for Microsoft Visual Studio Products (August 2025)

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-53773 Note that Nessu...

KLA91073 DoS vulnerability in Microsoft Developer Tools

Denial of service vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to cause denial of service. Original advisories CVE-2025-6965 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Visual-Studio CVE list...

PT-2025-33298 · Rockwell Automation · Studio 5000 Logix Designer

Name of the Vulnerable Software and Affected Versions: Studio 5000 Logix Designer affected versions not specified Description: A security issue exists in Studio 5000 Logix Designer related to unsafe handling of environment variables. When a specified path does not contain a valid file, the softwa...

Rockwell Automation Studio 5000 Logix Designer 安全漏洞

Rockwell Automation Studio 5000 Logix Designer is a Windows-based application from Rockwell Automation, Inc. It is used to build programs for PLCs. A security vulnerability exists in Rockwell Automation Studio 5000 Logix Designer that stems from improper handling of environment variables could...

CVE-2011-10015

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer 256 bytes without proper bounds checking. Exploitation allows...

CVE-2011-10015 Cytel Studio <= 9.0 .CY3 File Stack Buffer Overflow

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer 256 bytes without proper bounds checking. Exploitation allows...

CVE-2011-10015

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer 256 bytes without proper bounds checking. Exploitation allows...

CVE-2011-10015

CVE-2011-10015 affects Cytel Studio 9.0 and earlier. The vulnerability is a stack-based buffer overflow in the CY3 file parser: user-controlled strings are copied into a fixed-size 256-byte stack buffer without proper bounds checking, leading to arbitrary code execution when a crafted CY3 file is...

CVE-2011-10015 Cytel Studio <= 9.0 .CY3 File Stack Buffer Overflow

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer 256 bytes without proper bounds checking. Exploitation allows...

CVE-2025-54063

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on a...

CVE-2025-52385

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...

CVE-2025-52385

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...

CVE-2025-54382

Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...

CVE-2025-54074

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth...

CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure

Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...

CVE-2025-54382

Cherry Studio (desktop client) version 1.5.1 is affected by an RCE vulnerability when connecting to streamableHttp MCP servers due to the server’s implicit trust in OAuth redirection URLs and improper URL sanitization. The issue is mitigated by upgrading to version 1.5.2. Exploitation status is n...