CVE-2025-28129

Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking...

CVE-2025-28129

Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking...

CVE-2025-8917 Path Traversal Leading to Remote Code Execution in allegroai/clearml

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical fil...

EUVD-2025-32428

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0...

EUVD-2025-24891

Malicious code in bioql PyPI...

EUVD-2025-26930

Malicious code in bioql PyPI...

EUVD-2025-29766

Malicious code in bioql PyPI...

EUVD-2025-29767

Malicious code in bioql PyPI...

EUVD-2025-30629

Malicious code in bioql PyPI...

EUVD-2023-43737

Malicious code in bioql PyPI...

EUVD-2025-31688

Malicious code in bioql PyPI...

EUVD-2021-28047

Malicious code in bioql PyPI...

EUVD-2023-53407

Malicious code in bioql PyPI...

CVE-2025-49090

The Matrix specification before 1.16 i.e., with a room version before 12 and State Resolution before 2.1 has deficient state resolution...

CVE-2025-10191

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpostshippingstatus' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-10191

CVE-2025-10191 concerns the WordPress plugin Big Post Shipping for WooCommerce . The vulnerability is a Stored Cross-Site Scripting (XSS) in the shortcode wooboigpost_shipping_status. Affected versions are up to 2.1.1 (Wordfence listing confirms patching in 2.1.2). The issue stems from insufficie...

CVE-2025-59833 FlagForgeCTF Hint Exposure via API

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

CVE-2025-59833

Flag Forge CTI platform vulnerable versions 2.1.0–2.2.9 expose hints in plaintext within the GET /api/problems/:id response, revealing unreleased hints regardless of deduction. This information disclosure undermines business logic and challenge integrity. The issue is patched in version 2.3.0. Re...

CVE-2025-59827 FlagForgeCTF is Missing Authorization in main-v2

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

PT-2025-39348

Name of the Vulnerable Software and Affected Versions Flag Forge versions prior to 2.2.0 Description Flag Forge is a Capture The Flag CTF platform. The /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges, such as Staff, to...