WordPress Wigi <= 2.0.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Wigi versions = 2.0.1...

CVE-2025-31600

Cross-Site Request Forgery CSRF vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through = 2.6.0...

STMicroelectronics X-CUBE-AZRTOS-WL 缓冲区错误漏洞

STMicroelectronics X-CUBE-AZRTOS-WL is an Azure RTOS-based development kit for STM32 microcontrollers from STMicroelectronics, Switzerland. A security vulnerability exists in STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, which stems from a buffer overflow in the FileX internal RAM interface...

WordPress Themify Edmin theme <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Edmin versions = 2.0.0...

WordPress Google SEO Pressor Snippet plugin <= 2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Google SEO Pressor Snippet versions = 2.0...

youkefu 代码问题漏洞

youkefu is a customer service support application by the individual developer zhangyanbo2007. A code issue vulnerability exists in youkefu version 4.2.0, which stems from an incorrect manipulation of the parameter url that can lead to server-side request forgery...

TRENDnet TEW-411BRP+ 安全漏洞

The TRENDnet TEW-411BRP+ is a smart switch from Trendnet, Inc. A security vulnerability exists in the TRENDnet TEW-411BRP+ version 2.07 that stems from a null pointer dereference issue in the HTTP request processing component...

WordPress YouTube SimpleGallery plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin YouTube SimpleGallery versions = 2.0.6...

CVE-2023-53020 l2tp: close all race conditions in l2tp_tunnel_register()

In the Linux kernel, the following vulnerability has been resolved: l2tp: close all race conditions in l2tptunnelregister The code in l2tptunnelregister is racy in several ways: 1. It modifies the tunnel socket after publishing it. 2. It calls setupudptunnelsock on an existing socket without...

WordPress wpShopGermany IT-RECHT KANZLEI plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin wpShopGermany IT-RECHT KANZLEI versions = 2.0...

CVE-2024-55073

A Broken Object Level Authorization vulnerability in the component /api/users/user-id of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household...

CVE-2024-55070

A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permissions...

WordPress plugin wpShopGermany IT-RECHT KANZLEI 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-13135

Name of the Vulnerable Software and Affected Versions ThemeHunk Big Store versions 2.0.8 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations For ThemeHunk Big Store...

CVE-2025-23680

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Narnoo Narnoo Operator narnoo-shortcodes allows Reflected XSS.This issue affects Narnoo Operator: from n/a through = 2.0.0...

au.com.turingg:turingg-files (=0.0.1), au.com.turingg:turingg-mimak (=1.0.0) +875 more potentially affected by CVE-2025-27553 via org.apache.commons:commons-vfs2 (>=2.0 <=2.1)

org.apache.commons:commons-vfs2 MAVEN version =2.0, =0.0.4, =1.0.0, =1.0.0, =3.6.1, =3.11.0, =1.0-alpha-1, =1.0-alpha-1, =0.5, =0.5.1 and more Source cves: CVE-2025-27553 Source advisory: OSV:GHSA-9Q4X-FR4M-JP86...

LLaVA 资源管理错误漏洞

LLaVA is an application by Haotian Liu, an individual developer. A resource management error vulnerability exists in LLaVA v1.2.0, which stems from a file upload request being mishandled, which could lead to a denial of service...

NetEase QAnything 路径遍历漏洞

NetEase QAnything is a local knowledgebase question and answer system from China's NetEase that is designed to support files or databases in any format, and can be installed and used offline. A path traversal vulnerability exists in NetEase QAnything version v2.0.0, which stems from an unvalidate...

WordPress Narnoo Operator plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Narnoo Operator versions = 2.0.0...

CVE-2023-37933

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests...