CVE-2024-13619

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

setuptools 路径遍历漏洞

setuptools is a Python library open-sourced by PyPI. A path traversal vulnerability exists in versions of setuptools prior to 78.1.1, which stems from path traversal and could lead to remote code execution...

CVE-2024-9831

The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-6690

The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites...

CVE-2024-9450

The CVE-2024-9450 entry concerns the Free Booking Plugin for Hotels, Restaurants and Car Rentals (WordPress). Affected versions are prior to 1.3.15, where updating plugin settings lacks a CSRF check. This enables a logged-in subscriber to change settings via CSRF, potentially altering configurati...

CVE-2024-9236 Team Members Showcase < 4.4.2 - Editor+ Stored XSS

The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9182 Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS

The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

WordPress plugin VikBooking Hotel Booking Engine & PMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Drupal IFrame Remove Filter 跨站脚本漏洞

Drupal IFrame Remove Filter is a module plugin in the Drupal content management system from the Drupal community. A cross-site scripting vulnerability exists in Drupal IFrame Remove Filter versions prior to 2.0.5, which stems from improper input neutralization and could lead to cross-site scripti...

iTop 安全漏洞

iTop is a simple, web-based IT service management tool from Combodo Open Source. A security vulnerability exists in iTop versions prior to 3.2.1 that stems from a regular expression denial of service that may affect the server...

Intel oneAPI DPC++/C++ Compiler 代码问题漏洞

Intel oneAPI DPC++/C++ Compiler is a compiler from Intel Corporation USA. A code issue vulnerability exists in Intel oneAPI DPC++/C++ Compiler versions prior to 2025.0.0, which stems from an uncontrolled search path that could lead to local elevation of privilege...

WordPress plugin Everest Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE versions prior to 17.11.2, whi...

CVE-2025-0669 BOINC Server Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in BOINC Server allows Cross Site Request Forgery.This issue affects BOINC Server: before 1.4.3...

CVE-2025-0668 BOINC Server Multiple SQL Injections

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: before 1.4.5...

dropbear 安全漏洞

dropbear is an application by Matt Johnston Personal Developer. A security vulnerability exists in dropbear versions prior to 2025.88 that stems from an untrusted hostname parameter in the dbclient leading to command injection...

Envoy 安全漏洞

Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in Envoy versions prior to 1.34.1 that stems from a URI template matcher error excluding characters, which could lead to an RBAC rule bypass...

goshs 访问控制错误漏洞

goshs is a simple HTTP Server written in Go by Patrick Hener Personal Developer. An access control error vulnerability exists in goshs versions prior to 1.0.5 that stems from not checking the cli option -c, which could lead to arbitrary command execution...

Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x39x-9qw5-ghrf. This link is maintained to preserve external references. Original Description In browser-use aka Browser Use before 0.1.45, URL parsing of alloweddomains is mishandled because userinfo can be...

obfstr Type Confusion vulnerability

In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an invalid value...