Bottinelli Informatical Vedo Suite Server-Side Request Forgery Vulnerability

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. Bottinelli Informatical Vedo Suite suffers from a server-side request forgery vulnerability, which originates from the /apivedo/video/preview endpoint that do...

CVE-2025-55586

CVE-2025-55586 affects TOTOLINK A3002R v4.0.0-B20230531.1404. The flaw is a buffer overflow in the url parameter of /boafrm/formFilter, leading to a Denial of Service when fed with crafted input. The available sources confirm the issue but do not provide a definitive patch; PT-Security notes ther...

PT-2025-33525 · WordPress · Anber Elementor Addon

Name of the Vulnerable Software and Affected Versions: Anber Elementor Addon versions prior to 1.0.2 Description: The Anber Elementor Addon plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2025-8462

CVE-2025-8462 covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin “RT Easy Builder – Advanced addons for Elementor.” The issue arises from insufficient input sanitization and output escaping of the social URL parameter, affecting all versions up to 2.3. Authenticated attack...

PT-2025-32617 · WordPress · Rt Easy Builder – Advanced Addons For Elementor

Name of the Vulnerable Software and Affected Versions: RT Easy Builder – Advanced addons for Elementor plugin for WordPress versions prior to 2.3 Description: The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the social...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

PT-2025-32222 · Bottinelli Informatical · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Bottinelli Informatical Vedo Suite version 2024.17 Description: Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /api vedo/video/preview endpoint. This allows remote authenticated attackers t...

XBoot 代码问题漏洞

XBoot is a one-stop front-end and back-end separation rapid development platform for Exrick individual developers. A code issue vulnerability exists in XBoot 3.3.4 and prior versions, which stems from a server-side request forgery due to incorrect manipulation of the loginUrl parameter...

The vulnerability of the built-in boa server (/boafrm/formRoute) of the TOTOLINK X15 router microprogramming software allows a hacker to cause a service failure.

The vulnerability of the built-in boa server /boafrm/formRoute of the TOTOLINK X15 router software lies in the fact that the operation exceeds the buffer boundaries in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious actor to cause service failures...

The vulnerability of the built-in BOA server (/boafrm/formMultiAPVLAN) of the TOTOLINK X15 router’s microprogramming software allows a hacker to cause a service failure.

The vulnerability of the built-in server boa /boafrm/formMultiAPVLAN of the TOTOLINK X15 microprogrammed router software is related to the issue where the operation’s output goes beyond the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a remote...

CVE-2025-8246

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The...

mall 代码注入漏洞

mall is a macro personal developer of a set of e-commerce system, including the front mall system and backend management system. mall 1.0.3 and previous versions of code injection vulnerability, the vulnerability stems from the file / swagger-ui/index.html parameter configUrl lead to cross-site...

CVE-2025-6387

The WP Get The Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter in versions up to 1.5. Authenticated attackers with Contributor-level access and above can inject scripts that execute when a user visits the affected page. The vulnerability details and r...

PublicCMS 输入验证错误漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS 5.202506.a and earlier versions, which stems from an open redirect due to incorrect manipulation of the parameter url in the file preview.html...

Arbitrary Command Injection

Overview @translated/lara-mcp is a Lara API official MCP server Affected versions of this package are vulnerable to Arbitrary Command Injection via the importTmx function in importtmx.ts. An attacker can execute arbitrary system commands by supplying crafted input to the tmxurl parameter, which i...

📄 Beakon Cross Site Scripting / Open Redirection

Beakon versions prior to 5.4.3 suffer from cross site scripting and open redirection vulnerabilities. I am submitting a news article for publishing my recent Zero day vulnerability. I have already contacted MITRE and have CVE-2025-46102 reserved now. Please find below details: Title: Unsensitized...

CVE-2025-27889

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker...

CVE-2025-27889

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker...