CVE-2023-43378

A cross-site scripting XSS vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento11 parameter...

Tenda W12 Buffer Overflow Vulnerability

The Tenda W12 is a wireless router that provides wireless network connectivity. A buffer overflow vulnerability exists in Tenda W12 version 3.0.0.5, which originates from the cgiWifiRadioSet function in the /bin/httpd file that fails to properly validate input data when processing a specific...

GHSA-HQHQ-HP5X-XP3W GoBGP does not properly check the input length

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

UBUNTU-CVE-2025-43972

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

CVE-2025-32628 WordPress Crowdfunding for WooCommerce Plugin <= 3.1.12 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Crowdfunding for WooCommerce allows Reflected XSS. This issue affects Crowdfunding for WooCommerce: from n/a through 3.1.12...

BlogCMS 安全漏洞

BlogCMS is a PHP and MySQL based blogging system by Pramod Mahato Individual Developer in India. A security vulnerability exists in BlogCMS version 3.1.15, which stems from improper handling of the /bid/1/admin/entry-edit/ path, which could allow remote attackers to obtain sensitive information...

WordPress Rescue Shortcodes plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Rescue Shortcodes versions = 3.1...

WordPress plugin Slazzer Background Changer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exis...

WordPress plugin WordPress REST API Authentication 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2024-44843

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests...

CVE-2025-29213

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file...

GHSA-9GQV-WP59-FQ42 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

JeeWMS 安全漏洞

JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. A security vulnerability exists in JeeWMS version 3.7, which originates from an arbitrary file override in the servicemigrateMigrateForm.java component, which could lead to the execution of arbitrary code...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt in China. An information disclosure vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which can be exploited by an unauthenticated attacker to query API endpoints and obtain device details...

CVE-2025-29213

CVE-2025-29213 affects JeeWMS v3.7 in the service migrate module, specifically the MigrateForm.java component. The vulnerability is a zip-slip flaw that can lead to arbitrary code execution when processing crafted ZIP files. Documents consistently name the vulnerable path as \service\migrate\Migr...

CVE-2024-44843

CVE-2024-44843 affects SteVe v3.7.1. The issue is in the WebSocket handshake process, enabling an attacker to bypass authentication and deliver crafted OCPP requests to execute arbitrary commands. Documented impact includes authentication bypass and potential command execution on the affected ser...

IBM Aspera Console 加密问题漏洞

IBM Aspera Console is a Web-based application from International Business Machines IBM. Allows users to centrally manage, monitor and control Aspera servers nodes and transports. An encryption issue vulnerability exists in IBM Aspera Console 3.4.4 and prior versions, which stems from the use of a...

eCommerce-website-in-PHP 安全漏洞

eCommerce-website-in-PHP is a free and open source php e-commerce platform by scriptandtools individual developers. A security vulnerability exists in eCommerce-website-in-PHP version 3.0, which stems from vulnerability to cross-site request forgery attacks...

eCommerce-website-in-PHP 安全漏洞

eCommerce-website-in-PHP is a free and open source php e-commerce platform for scriptandtools individual developers. A security vulnerability exists in eCommerce-website-in-PHP version 3.0, which stems from an improperly restricted authentication attempt in file /login.php...

GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)

Exploit Title: GestioIP 3.5.7 - Reflected Cross-Site Scripting Reflected XSS Exploit Author: m4xth0r Maximiliano Belino Author website: https://maxibelino.github.io/ Author email max.cybersecurity at belino.com GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859...