PT-2025-31686 · Raidsonic · Ib-Nas5220 +1

Name of the Vulnerable Software and Affected Versions: Raidsonic NAS devices versions IB-NAS5220 and IB-NAS4220 Description: An OS command injection issue exists due to improper sanitization of user-supplied input. The timeHandler.cgi API endpoint is vulnerable, allowing remote attackers to injec...

Arbitrary File Upload

Overview marshmallow/nova-tiptap is a Laravel Nova tiptap editor field. Affected versions of this package are vulnerable to Arbitrary File Upload via the /nova-tiptap/api/file endpoint, which lacks authentication and file validation. An attacker can upload arbitrary files, including executable or...

VulnCheck KEV: CVE-2022-3481

The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection...

Bykea: MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint

MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint An unauthenticated health check endpoint was discovered that exposed basic system and infrastructure details...

CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2021-24599

The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data...

📄 WordPress SureTriggers 1.0.78 Authentication Bypass / Remote Code Execution

This Metasploit module exploits an authorization bypass in the WordPress SureTriggers plugin versions 1.0.78 and below to create an administrator account and then uploads and executes a PHP payload. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2024-13925

The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space,...

CVE-2024-13925

The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space,...

CVE-2024-13925 Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging

The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space,...

PT-2025-16936 · Klarna · Klarna Checkout For Woocommerce

Name of the Vulnerable Software and Affected Versions: Klarna Checkout for WooCommerce versions prior to 2.13.5 Description: The issue exposes an unauthenticated WooCommerce Ajax endpoint, allowing an attacker to flood log files with data, potentially consuming disk space rapidly. Recommendations...

CVE-2024-7983 Denial of Service in open-webui/open-webui

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until...

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

...

DEBIAN-CVE-2025-0426

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk...

CVE-2025-0426

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk...

CVE-2025-0426

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk...

Kubernetes 安全漏洞

Kubernetes K8s is an open source system from Kubernetes Open Source for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes that stems from the fact that a large number of container checkpoint requests to an unauthenticat...

OpenUI 访问控制错误漏洞

OpenUI is a UI program open-sourced by Weights & Biases. OpenUI suffers from an access control error vulnerability that stems from an unauthenticated endpoint allowing AWS S3 storage bucket file uploads and downloads, which can lead to denial of service, storage-based cross-site scripting, and...

SUSE CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-38856 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...