CVE-2021-21315

The System Information Library for Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. ...

CVE-2025-32442 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a slightly altered content type such as...

CVE-2025-32442

The CVE-2025-32442 issue affects Fastify (Node.js) where applications that specify different validation strategies for multiple content types can bypass validation by supplying a slightly altered Content-Type (e.g., different casing or whitespace before ";"). Affected versions include Fastify 5.0...

CVE-2025-31008

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through = 5.3.1...

PT-2025-5865 · Unknown · Netmod Vpn Client

Name of the Vulnerable Software and Affected Versions: NetMod VPN Client version 5.3.1 Description: The issue arises due to the improper validation of dynamically loaded libraries, allowing an attacker to execute arbitrary code by placing a malicious DLL in a directory where the application loads...

WordPress Side Menu Lite Plugin <= 5.3.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Khang Duong in WordPress Plugin Side Menu Lite versions = 5.3.1...

PT-2025-5538 · Unknown · Side Menu Lite

Name of the Vulnerable Software and Affected Versions: Side Menu Lite versions through 5.3.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

flatnotes 安全漏洞

flatnotes is a self-hosted, database-less notes web application by the individual developer Adam Dullage. A security vulnerability exists in flatnotes version v5.3.1 that originates from a denial of service via the upload image feature...

WordPress plugin Custom Query Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Analytify 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

CVE-2024-32890 Stored Cross-site Scripting in results JSON API in librespeed/speedtest

librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The processedString field in the ispinfo parameter is missing neutralization. It...

WordPress WooCommerce License Manager Plugin <= 5.3.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce License Manager Type Plugin Vulnerable versions = 5.3.1 Fixed in 5.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29121 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ebf509e643b0 Credits Dave Jong Patchstack...

CVE-2023-40580 Freighter mnemonic phrase may be accessed by Javascript through a private API

Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1...

Freighter 信息泄露漏洞

Freighter is an extension to Stellar open source. An information disclosure vulnerability exists in Freighter 5.3.1 and earlier versions, which stems from a vulnerability that allows an attacker to access mnemonics via a private API using Javascript...

PT-2023-27518 · Freighter · Freighter

Name of the Vulnerable Software and Affected Versions: Freighter versions prior to 5.3.1 Description: The issue impacts access control to the mnemonic recovery phrase, potentially allowing a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked...

Acronis Cyber Infrastructure 安全漏洞

Acronis Cyber Infrastructure is a simple, efficient and secure solution for edge workloads from Acronis Switzerland. A security vulnerability exists in Acronis Cyber Infrastructure ACI versions prior to 5.3.1-38 that stems from improper authorization and results in the disclosure of sensitive...

PT-2022-24955 · Unknown +2 · Parse Server +2

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.18 Parse Server versions prior to 5.3.1 on the 5.X branch Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An attacker can use a prototype...

PT-2022-25538 · Unknown · Mipc Camera Firmware

Name of the Vulnerable Software and Affected Versions: mIPC camera firmware version 5.3.1.2003161406 Description: The issue is related to an unlimited strcpy on user input when setting a locale file, which leads to a stack buffer overflow. This occurs in the mIPC camera firmware. Recommendations:...

NodeJS System Information Library Command Injection (CVE-2021-21315)

Binary data nodejscve-2021-21315.nbin...

CVE-2022-31011 TiDB authentication bypass vulnerability

TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing HTAP workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access...