35 matches found
PT-2026-69343
Name of the Vulnerable Software and Affected Versions vitepos WordPress plugin versions prior to 3.6.0 Description An issue exists where an identifier from a REST request body is not sanitized or parameterized before being used in a database query within a report endpoint. This allows users with...
CVE-2026-5781: Improper Authorization
An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user modification privileges to escalate their privileges by sending an HTTP request with a manipulated 'identifier' field. Successful exploitati...
PT-2026-35715
Name of the Vulnerable Software and Affected Versions Minerva version 3.6.0 Description An insecure direct object reference IDOR issue exists in the '/minerva/moUser/show/' endpoint. An authenticated user can access data of other registered users and obtain a user list by modifying the ID variabl...
CVE-2023-40787
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...
EUVD-2023-2221
Malicious code in bioql PyPI...
EUVD-2022-32566
Malicious code in bioql PyPI...
Realtek AP-Router SDK Security Vulnerability
Realtek AP-Router SDK is a software package for wireless chipsets from Realtek Semiconductor Realtek, a Chinese company. A security vulnerability exists in the Realtek AP-Router SDK that stems from a stack-based buffer overflow vulnerability in the boa formRoute feature, which can lead to remote...
Realtek AP-Router SDK Input Validation Error Vulnerability
The Realtek AP-Router SDK is a software package for wireless chipsets from Realtek Semiconductor Realtek of China. An input validation error vulnerability exists in the Realtek AP-Router SDK, which stems from an integer overflow vulnerability in the boa updateConfigIntoFlash function, which can...
CVE-2024-25407
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service DoS by using the predicted transaction ID's to terminate other transactions...
Cross site request forgery (csrf)
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service DoS by using the predicted transaction ID's to terminate other transactions...
CVE-2024-25407
CVE-2024-25407 affects SteVe v3.6.0. The issue is that StartTransaction requests use predictable transaction IDs, enabling an attacker to terminate other transactions and cause a DoS. The CVE records consistently describe this vulnerability and note a PoC in one data source; no concrete remediati...
CVE-2024-25407
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service DoS by using the predicted transaction ID's to terminate other transactions...
CVE-2024-25407
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service DoS by using the predicted transaction ID's to terminate other transactions...
CVE-2023-40788
SpringBlade 3.6.0 to remediate.
SpringBlade vulnerable to SQL injection
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...
CVE-2023-40787
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...
CVE-2023-40787
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...
CVE-2023-40787
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...
Fedora 38 : libheif (2023-fd63c401df)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-fd63c401df advisory. Fixes an incompatibility with AOM v3.6.0 and includes a couple of smaller fixes. Also fixes a stack overflow with some crafted images. Tenable has extracted...
