12387 matches found
CVE-2025-9961
CVE-2025-9961 involves a stack-based buffer overflow in TP-Link’s CWMP binary on AX10 and AX1500 routers, enabling authenticated RCE via a MITM-exploited SetParameterValues flow. Affected: AX10 (before 1.2.1) and AX1500 (before 1.3.11). Root cause: improper bounds checking in the cwmp service lea...
TP-LINK AX10和TP-LINK AX1500 安全漏洞
TP-LINK AX10 and TP-LINK AX1500 are both products of China P&L TP-LINK.TP-LINK AX10 is a router.TP-LINK AX1500 is a modem. A security vulnerability exists in the TP-LINK AX10 version prior to 1.2.1 and the TP-LINK AX1500 version prior to 1.3.11, which stems from the CWMP binary could be used to...
CVE-2025-55748
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
CVE-2025-49401
Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: from n/a through = 4.0...
MAL-2025-46130 Malicious code in spin-spend-ten (npm)
The package spin-spend-ten was found to contain malicious code...
Malicious code in opinion-massage-ten (npm)
The package opinion-massage-ten was found to contain malicious code...
Malicious code in spin-spend-ten (npm)
The package spin-spend-ten was found to contain malicious code...
MAL-2025-45468 Malicious code in opinion-massage-ten (npm)
The package opinion-massage-ten was found to contain malicious code...
CVE-2025-10013 Portabilis i-Educar exportacao-para-o-seb access control
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...
CVE-2025-58852
CVE-2025-58852 affects the WordPress MSTW League Manager plugin (
WordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Developer Tools Blocker versions = 3.2.1...
PT-2025-36226
Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A security issue has been identified in Portabilis i-Educar. Manipulation of the ref cod aluno argument in the educar historico escolar lst.php file can lead to SQL injection. This issue ca...
i-Educar 安全漏洞
i-Educar is a free educational software from Portábilis Open Source. A security vulnerability exists in i-Educar version 2.10 and earlier, which stems from a SQL injection due to the incorrect operation of the parameter refcodaluno in the file educarhistoricoescolarlst.php...
PT-2025-36191
Name of the Vulnerable Software and Affected Versions: MSTW League Manager versions through 2.10 Description: A Cross-Site Request Forgery CSRF vulnerability exists in MSTW League Manager, which also allows for Stored Cross-Site Scripting XSS. Recommendations: At the moment, there is no informati...
PT-2025-36247
Name of the Vulnerable Software and Affected Versions: Quiz And Survey Master versions through 10.2.5 Description: Deserialization of untrusted data in ExpressTech Systems Quiz And Survey Master allows for object injection. Recommendations: At the moment, there is no information about a newer...
i-Educar 安全漏洞
i-Educar is a free educational software from Portábilis Open Source. A security vulnerability exists in i-Educar version 2.10 and earlier, which stems from improper access control in the file /exportacao-para-o-seb...
raid10: cleanup memleak at raid10_make_request
...
md/raid1,raid10: don't ignore IO flags
...