CVE-2025-28408

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...

PT-2025-15293 · Unknown · Apollo-Compiler

Name of the Vulnerable Software and Affected Versions: apollo-compiler versions prior to 1.27.0 Description: The issue concerns a query-based compiler for the GraphQL query language. Prior to version 1.27.0, a vulnerability allowed queries with deeply nested and reused named fragments to be...

CVE-2025-2299

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary we...

PT-2025-15049 · WordPress · Read More & Accordion

Name of the Vulnerable Software and Affected Versions: Read More & Accordion plugin for WordPress versions up to, and including, 3.4.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the addNewButtons function. This allows...

CVE-2025-31477

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...

CVE-2025-3099

The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the 'MySolrServerSettings' page. This makes it possible for unauthenticated attackers to upda...

Mitel MiCollab <= 9.8 SP2 (9.8.2.12) Multiple Vulnerabilities (MISA-2024-0029)

According to its self-reported version, the instance of Mitel MiCollab running on the remote web server is prior to 9.8 SP2 9.8.2.12 and is, therefore, affected by multiple vulnerabilities: - A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP1 FP2...

PT-2025-14862 · WordPress · Woffice Core

Name of the Vulnerable Software and Affected Versions: Woffice Core plugin for WordPress versions up to and including 5.4.21 Description: The issue is due to missing or incorrect nonce validation on the woffice handle user approval actions function, making it possible for unauthenticated attacker...

CVE-2025-31489 MinIO performs incomplete signature validation for unsigned-trailer uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

BIT-JOOMLA-2023-23754 [20230501] - Core - Open Redirect and XSS within the mfa select

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen...

BIT-JOOMLA-2020-24598

An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of comcontent leads to an open redirect...

BIT-JOOMLA-2020-13762

In Joomla! before 3.9.19, incorrect input validation of the module tag option in commodules allows XSS...

BIT-JOOMLA-2020-13761

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

BIT-DOLIBARR-2023-4197 Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

Improper input validation in Dolibarr ERP CRM = v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code...

CVE-2025-30471

A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A remote user may be able to cause a denial-of-service...

CVE-2025-30452

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An input validation issue was addressed...

CVE-2025-30080

Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service software abort...

CVE-2025-3097

The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-3099

The CVE-2025-3099 entry concerns the Advanced Search by My Solr Server WordPress plugin. It is described as vulnerable to Cross-Site Request Forgery in all versions up to 2.0.5 due to missing or incorrect nonce validation on the MySolrServerSettings page. The impact stated is that unauthenticated...

Next.js 信息泄露漏洞

Next.js is a React framework open-sourced by Vercel. An information disclosure vulnerability exists in Next.js, which stems from insufficient validation of the x-middleware-subrequest-id, which could lead to information disclosure. The following versions are affected: versions prior to 12.3.6,...