77 matches found
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Affected Versions: Tested on current dev branch build fingerprint 505...7bd86 CVSS v4 Score: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Privileges Required: Web application admin account for file write, any authenticated user for RCE trigger --- Summary Two separate...
Exploit for CVE-2025-14502
CVE-2025-14502 Vulnerability Analysis Report Vulnerability...
CVE-2021-36888
creationtimestamp| type| source ---|---|--- 2025-11-29 19:45:46+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-36888.yaml 2025-12-01 21:02:33+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda4o4qo2a 2026-06-23...
CVE-2025-9316
creationtimestamp| type| source ---|---|--- 2025-11-18 18:14:32+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-9316.yaml 2025-11-20 13:07:24+00:00| seen|...
CVE-2025-12497
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'argsextratemplatepath' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...
CVE-2025-12497 Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'argsextratemplatepath' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...
PT-2025-45104
Name of the Vulnerable Software and Affected Versions Premium Portfolio Features for Phlox theme plugin for WordPress versions prior to 2.3.11 Description The Premium Portfolio Features for Phlox theme plugin for WordPress is susceptible to Local File Inclusion in versions prior to 2.3.11. This...
CVE-2025-60447
A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Django vulnerabilities (USN-7794-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7794-1 advisory. It was discovered that Django incorrectly handled special characters in the QuerySet...
USN-7794-1 python-django vulnerabilities
It was discovered that Django incorrectly handled special characters in the QuerySet function calls. A remote attacker could possibly use this issue to perform SQL injection attacks. CVE-2025-59681 It was discovered that Django incorrectly handled files with the same path prefix when starting wit...
PT-2025-38525
Name of the Vulnerable Software and Affected Versions JeecgBoot versions through 3.8.2 Description A weakness exists in JeecgBoot that may lead to improper authorization. The issue affects an unknown function within the /message/sysMessageTemplate/sendMsg file. The exploit for this issue has been...
CVE-2019-17228
creationtimestamp| type| source ---|---|--- 2025-09-18 11:48:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-17228.yaml 2025-09-19 21:02:32+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lz7r6sujjv2r...
PT-2025-36368
Name of the Vulnerable Software and Affected Versions: itsourcecode POS Point of Sale System version 1.0 Description: A security flaw exists in itsourcecode POS Point of Sale System 1.0. The vulnerability affects unknown code within the /inventory/main/vendors/datatables/unit...
Vvveb 安全漏洞
Vvveb is a powerful and easy-to-use CMS from Givan Individual Developers for building websites, blogs or e-commerce stores. A security vulnerability exists in Vvveb version 1.0.7.2, which stems from cross-site scripting due to incorrect manipulation of the parameters Email/Password in the file...
VulnCheck KEV: CVE-2023-0159
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may ...
CVE-2023-0159
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may ...
CVE-2025-46821 Envoy vulnerable to bypass of RBAC uri_template permission
Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the character from a set of valid characters in the URI path. As a result URI path containing the character will not match a URI template...
FastCMS 代码注入漏洞
FastCMS is a content management system from FastCMS Inc. A code injection vulnerability exists in FastCMS 0.1.5 and earlier versions, which originates from the file /fastcms.html/template/menu of the component template menu can lead to cross-site scripting attacks...
