6985 matches found
CVE-2025-48944
vLLM is an inference and serving engine for large language models LLMs. In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality ...
Employee Record Management System /admin/editempexp.php File SQL Injection Vulnerability
Employee Record Management System is an employee record management system. Employee Record Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter emp1name in the file /admin/editempexp.php. An...
News Portal Project /edit-subcategory.php File SQL Injection Vulnerability
News Portal Project is a news portal project. News Portal Project suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements for the parameter Category in the file /admin/edit-subcategory.php. An attacker can exploit this...
PT-2025-23060 · Dropbox · Dropbox
Name of the Vulnerable Software and Affected Versions: Dropbox affected versions not specified Description: The issue concerns an unvalidated redirect in Dropbox. No further details are provided about the nature of the issue, affected devices, or real-world incidents. Recommendations: At the...
PT-2025-23050 · Apache · Apache Struts
Name of the Vulnerable Software and Affected Versions: Apache Struts affected versions not specified Description: The issue concerns an unvalidated redirect to a malicious site. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents...
PT-2025-23353 · Undefined · Undefined
CVE-2022-46734 - Apache HTTP Server Unvalidated Redirect CVE ID : CVE-2022-46734 Published : May 28, 2025, 7:15 p.m. | 2 hours, 15 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused Severity: 0.0 | NA Visit the...
PT-2025-22966 · Oracle · Oracle Weblogic Server
Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server affected versions not specified Description: The issue concerns an unvalidated redirect in Oracle WebLogic Server. No information is provided about the estimated number of potentially affected devices worldwide or...
auth-js 路径遍历漏洞
auth-js is a Supabase Auth isomorphic Javascript library open-sourced by Supabase. A path traversal vulnerability exists in versions of auth-js prior to 2.69.1, which stems from an unvalidated user-supplied UUID and could lead to URL path traversal...
The vulnerability of the ath12k_station_assoc() function in the Atheros/Qualcomm wireless communication adapter support driver for Linux operating systems allows a hacker to induce a service failure.
The vulnerability of the ath12kstationassoc function in the Atheros/Qualcomm wireless adapter support driver for Linux operating systems is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the amdgpu_dm_initialize_drm_device() function in the DRI driver allows a hacker to cause a system failure. This vulnerability relates to AMD GPU-based Linux operating system hardware.
The vulnerability of the amdgpudminitializedrmdevice function in the DRI driver for AMD graphics cards in Linux operating systems is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...
PHPGurukul Employee Record Management System 注入漏洞
Employee Record Management System is an employee record management system. Employee Record Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Email in the file /loginerms.php. An attacker c...
CVE-2024-20367
A vulnerability in the web UI of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker...
CVE-2024-4900
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post...
CVE-2024-35180
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the callback parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0...
CVE-2024-3368
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-6362
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-31993
Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrapeimage function will retrieve an image based on a user-provided URL, however the provided URL is not validated to point to an external location and does not have any enforced rate limiting. The response from the...
CVE-2024-48572
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...
CVE-2024-53264
bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...