CVE-2019-17552

An issue was discovered in idreamsoft iCMS v7.0.14. There is a spiderproject.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload...

CVE-2019-8432

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...

CVE-2018-13865

An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...

CVE-2013-1786

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

WSO2 Identity Server（IS） 安全漏洞

WSO2 Identity Server IS is an identity server from the US-based WSO2 Inc. A security vulnerability exists in WSO2 Identity Server IS version 7.0.0 that stems from insufficient input validation and could lead to a reflective cross-site scripting attack...

CVE-2005-3281

Directory traversal vulnerability in NukeFixes 3.1 for PHP-Nuke 7.8 allows remote attackers to include arbitrary files via the file parameter...

CVE-2005-3016

Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors...

CVE-2024-42922

CVE-2024-42922 affects AAPanel v7.0.7, where an OS command injection vulnerability is reported. The connected sources describe the issue as an OS command injection that could enable remote command execution, impacting the affected web-based control panel. The CVSS vector provided indicates a netw...

CVE-2025-39351

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Restaurant WordPress allows Cross Site Request Forgery.This issue affects Grand Restaurant WordPress: from n/a through 7.0...

CVE-2025-47749

V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

WordPress plugin Grand Restaurant 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress plugin Grand Restaurant 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055

The CVE-2025-28055 entry concerns upset-gal-web v7.1.0, where the /api/music/v1/cover.ts endpoint is vulnerable to an arbitrary file read. CVSSv3.1 base score 7.5 (HIGH) with network access, no privileges, no user interaction required; impact limited to confidentiality. The root cause details are...

📄 VirtualBox 7.0.16 Privilege Escalation

VirtualBox version 7.0.16 suffers from a privilege escalation vulnerability. Exploit Title: VirtualBox 7.0.16 - Local Privilege Escalation Date: 2025-05-06 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Tested on: Win x64...

RTI Connext Professional 缓冲区错误漏洞

RTI Connext Professional is a connectivity platform from RTI USA designed to meet the demanding requirements of the Industrial Internet of Things IIoT. A buffer error vulnerability exists in RTI Connext Professional versions prior to 7.5.0, which stems from a heap buffer overflow that could resul...

WordPress plugin GamiPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Sixun Shanghui Business Management System 访问控制错误漏洞

Sixun Shanghui Business Management System is a group business management system from Sixun, a Chinese company. An access control error vulnerability exists in Sixun Shanghui Business Management System version 7, which stems from improper handling of files/api/GylOperator/LoadData, which could lea...

Elasticsearch 7.17.25 and 8.16.0 Security Update (ESA-2024-40)

Elasticsearch Uncontrolled Resource Consumption vulnerabilityESA-2024-40 Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash. Affected Versions:...

WordPress plugin Anything Popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...