7451 matches found
Suning EMall 安全漏洞
Suning EMall is an integrated online shopping platform of China-based Suning Ebay Suning Inc. A security vulnerability exists in Suning EMall iOS version 9.5.198, which originates from a specially crafted link that can access sensitive user information...
YuPao DirectHire 安全漏洞
YuPao DirectHire is a recruiting software from the Chinese company YuPao 鱼泡. A security vulnerability exists in YuPao DirectHire version 8.8.0, which originates from a specially crafted link that can access sensitive user information...
MUCFC Merchants Union Finance 安全漏洞
MUCFC Merchants Union Finance MUCFC is a credit loan installment borrowing platform from China Merchants Union MUCFC Corporation. A security vulnerability exists in MUCFC Merchants Union Finance iOS version 6.19.0, which originates from a specially crafted link that can access sensitive user...
Boohee Health 安全漏洞
Boohee Health 薄荷健康 is a weight loss and fitness light fasting management software from the Chinese company Boohee. A security vulnerability exists in Boohee Health version 13.0.13, which originates from a specially crafted link that can access sensitive user information...
IKEA 信息泄露漏洞
IKEA is a well-known furniture retail brand from Sweden by the Dutch company IKEA. It offers a wide range of home products and food products to fulfill life's needs. A security vulnerability exists in IKEA version 4.13.0 that originates from a specially crafted link that can access sensitive user...
PYSEC-2025-3 When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.
Published in 2019, the autodzee package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...
PYSEC-2025-4 When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.
Published in 2019, the automslc package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...
CVE-2025-22881
CVE-2025-22881 affects Delta Electronics CNCSoft-G2, a human-machine interface (HMI) software. The vulnerability is a heap-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying to a fixed-length heap buffer. An attacker can lure a target to vis...
GHSA-QCM9-87FM-RGPF vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2024-13494
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
CVE-2024-13494 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
CVE-2024-13494 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
CVE-2024-13494
CVE-2024-13494 : The WordPress File Upload plugin (WordPress File Upload) is vulnerable to Cross-Site Forgery (CSRF) in all versions through 4.25.2 due to missing/incorrect nonce validation in the wfu_file_details function. An unauthenticated attacker could modify details of uploaded files by tri...
A week in security (February 17 – February 23)
Last week on Malwarebytes Labs: Healthcare security lapses keep piling up SecTopRAT bundled in Chrome installer distributed via Google Ads Google Docs used by infostealer ACRStealer as part of attack DeepSeek found to be sharing user data with TikTok parent company ByteDance Malwarebytes introduc...
CVE-2020-6158
Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing...
CVE-2025-0352
Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to return information about other users...
CVE-2024-43196
IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses...
GHSA-95J3-435G-VJCP Leantime affected by Improper Neutralization of HTML Tags
Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address...
GHSA-V4Q9-437P-MHPG Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
Summary A cross-site scripting XSS vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not...
GHSA-63CR-XG3F-8JVR Leantime allows Stored Cross-Site Scripting (XSS)
Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...