EUVD-2025-200288

EverShop 2.0.1 allows an unauthenticated user to upload files and create directories within the /api/images endpoint...

📄 FortiWeb 8.0.1 Authentication Bypass

A critical authentication bypass vulnerability exists in FortiWeb web application firewalls that allows unauthenticated attackers to create administrative users via path traversal in the API endpoint. Version 8.0.1 is affected...

CVE-2025-12571 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON...

CVE-2025-12571

CVE-2025-12571 affects GitLab CE/EE, with unauthenticated users able to trigger a Denial of Service by sending specially crafted JSON payloads. Affected are versions 17.10 up to, but not including, 18.4.5; 18.5 up to, but not including, 18.5.3; and 18.6 up to, but not including, 18.6.1. GitLab re...

PT-2025-48179

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.10 through 18.4.4 GitLab CE/EE versions 18.5 through 18.5.2 GitLab CE/EE versions 18.6 through 18.6.0 Description An unauthenticated user could trigger a Denial of Service condition by submitting specially crafted...

WordPress plugin Return Refund and Exchange For WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-9977

CVE-2025-9977 affects Times Software E-Payroll. The issue stems from improper sanitization of data in a POST parameter during login, which could let an unauthenticated attacker cause a DoS and may enable SQL injection; command injection attempts have also produced detailed error messages exposing...

CVE-2025-62482

Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access...

CVE-2025-43515

The issue was addressed by refusing external connections by default. This issue is fixed in Compressor 4.11.1. An unauthenticated user on the same network as a Compressor server may be able to execute arbitrary code...

CVE-2025-43515

CVE-2025-43515 affects Apple Compressor. Concrete details across connected sources confirm that an unauthenticated user on the same network as a Compressor server may execute arbitrary code. The root fix is to refuse external connections by default, implemented in Compressor 4.11.1. References fr...

CVE-2025-43515

The issue was addressed by refusing external connections by default. This issue is fixed in Compressor 4.11.1. An unauthenticated user on the same network as a Compressor server may be able to execute arbitrary code...

CVE-2025-62482

Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access...

CVE-2025-62482 Zoom Workplace for Windows - Cross-site Scripting

Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access...

CVE-2025-62482

CVE-2025-62482 corresponds to a cross-site scripting flaw in Zoom Workplace for Windows, fixed in versions 6.5.10 and later. Affects Zoom Workplace prior to 6.5.10; an unauthenticated attacker could impact integrity via network access. Connected sources confirm the vulnerability and the vendor-pr...

PT-2025-46836

Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access...

About the security content of Compressor 4.11.1

About the security content of Compressor 4.11.1 This document describes the security content of Compressor 4.11.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...

CVE-2025-24834

Protection mechanism failure for some IntelR CIP software before version WINDCA2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result...

CVE-2025-35963

Insufficient control flow management for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of...

CVE-2025-35967

Out-of-bounds read for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This...

EUVD-2025-93473

Out-of-bounds read for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This...