PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Summary The parameter addlinks in the API /json/addpackage is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage. Details - Affected file：https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/filedatabase.pyL271 - Affected code: python...

Huawei EulerOS: Security Advisory for emacs (EulerOS-SA-2025-1949)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

📄 Microsoft SharePoint Server 2019 16.0.10383.20020 Remote Code Execution

Microsoft SharePoint Server 2019 version 16.0.10383.20020 proof of concept that demonstrates unauthenticated remote code execution by exploiting unsafe deserialization in SharePoint's ToolPane.aspx via the Scorecard:ExcelDataSet control. Exploit Title: Microsoft SharePoint Server 2019 – Remote Co...

PT-2025-32664 · Siemens · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to 3.0 Description: The application uses a Content Security Policy that allows unsafe script execution methods. This could allow an attacker to execute unauthorized scripts, potentially leading to...

📄 Wazuh Server Remote Code Execution

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are serialized as JSON and...

CLSA-2025-1754940060 Fix CVE(s): CVE-2025-27613, CVE-2025-27614, CVE-2025-46835

SECURITY UPDATE: multiple vulnerabilities in Gitk and Git GUI - debian/patches/CVE-2025-27614CVE-2025-27613CVE-2025-46835.patch: Prevent script execution via specially crafted filenames in Gitk. Sanitize filename handling to avoid unintended file creation/truncation. Validate directory names in G...

CVE-2025-7726

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description'...

BIT-LIBPYTHON-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs because sprintf is...

GHSA-RRGF-HCR9-JQ6H TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

Description A critical path traversal vulnerability CWE-22 has been identified in the reviewpaper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions. Impact...

PT-2025-32550 · Phptax · Phptax

Name of the Vulnerable Software and Affected Versions: PhpTax version 0.8 Description: PhpTax version 0.8 contains a remote code execution issue in drawimage.php. The pfilez GET parameter is passed to the exec function without proper sanitization. This allows a remote attacker to inject arbitrary...

Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)

Exploit Title: Microsoft SharePoint Server 2019 – Remote Code Execution RCE Google Dork: intitle:"Microsoft SharePoint" inurl:"/layouts/15/ToolPane.aspx" Date: 2025-08-07 Exploit Author: Agampreet Singh RedRoot Tool Maker – https://github.com/Agampreet-Singh/RedRoot Vendor Homepage:...

Linux Distros Unpatched Vulnerability : CVE-2024-55601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed bel...

PT-2025-40097

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the dmaengine subsystem, specifically within the Qualcomm BAM DMA driver. Insufficient error handling when required device tree properties clock and...

CVE-2012-10043

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy duri...

Linux Distros Unpatched Vulnerability : CVE-2025-37998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvswitch: Fix unsafe attribute parsing in outputuserspace This patch replaces the manual Netlink attribute iteration in outputuserspace with nlaforeachnested...

Linux Distros Unpatched Vulnerability : CVE-2024-57930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Have processstring also allow arrays In order to catch a common bug where a...

Linux Distros Unpatched Vulnerability : CVE-2024-46690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4deleggetattrconflict in presence of third party lease It is not safe to...

CVE-2012-10043

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy duri...

CVE-2012-10048 Zenoss 3.x showDaemonXMLConfig Command Execution

Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user...

CVE-2012-10043 ActFax 4.32 Client Importer Buffer Overflow

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy duri...