1111 matches found
CVE-2025-7835 iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due to missing or incorrect nonce validation on the 'ithoughtsaceupdateoptions' AJAX action. This makes it possible for unauthenticated attacke...
CVE-2025-4295
Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025...
Live Helper Chat 安全漏洞
Live Helper Chat is an open source plugin that supports online chat by an individual developer Live Helper Chat. Provides chat functionality for web platforms. A security vulnerability exists in Live Helper Chat version v4.60, which stems from insufficient validation of Telegram Bot Username...
CVE-2025-6231
An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file...
GHSA-6V2P-P543-PHR9 golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...
CVE-2025-7378
ASUSTOR ADM CVE-2025-7378 is an improper input validation vulnerability affecting ADM versions 4.1 through 4.3.1.R5A0, allowing arbitrary values to be injected into the NAS configuration file and potentially causing misconfiguration and unexpected NAS behavior. The issue is mitigated by updating ...
CVE-2025-3777 Improper Input Validation in huggingface/transformers
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...
CVE-2025-3777 Improper Input Validation in huggingface/transformers
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...
CVE-2025-7095 Comodo Internet Security Premium Update certificate validation
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an atta...
PT-2025-26639
Name of the Vulnerable Software and Affected Versions: pbkdf2 versions =3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. Recommendations: For versions =3.1.2, update to a version greater than 3.1.2...
CVE-2025-49081
CVE-2025-49081 is an input-validation flaw in the warehouse component of Absolute Secure Access, prior to server version 13.55. Attackers with system administrator privileges can impair the availability of the Secure Access administrative UI by sending invalid data over the network. No confidenti...
CVE-2024-56158 XWiki allows SQL injection in query endpoint of REST API with Oracle
XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. Thi...
CVE-2025-0052 FlashBlade DOS Vulnerability
Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service...
CVE-2025-4680
Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0...
CVE-2025-33031
An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station ...
CVE-2025-22243
VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting XSS attack due to improper input validation...
CVE-2025-49008
CVE-2025-49008 affects Atheos, a self-hosted browser-based cloud IDE. Prior to version 6.0.4, improper use of escapeshellcmd() in /components/codegit/traits/execute.php enables argument injection and arbitrary command execution. The vulnerability could lead to data breaches or server compromise f...
VMware vCenter Server 8.0 < 8.0 U3e Server Reflected XSS (CVE-2025-41228) (VMSA-2025-0010)
The version of VMware vCenter Server installed on the remote host is 8.0.x prior to 8.0 U3e. It is, therefore, affected by a vulnerability as referenced in the VMSA-2025-0010 advisory. - VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input...