ATOPHTTPD 安全漏洞

ATOPHTTPD is a library by the individual developer zhenwei pi. A security vulnerability exists in ATOPHTTPD version 2.8.0, which stems from a difference-one error that could lead to out-of-bounds reads...

WordPress plugin Video Share VOD 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

OPC cardsystems Webapp Aufwertung 安全漏洞

OPC cardsystems Webapp Aufwertung is a billing system from OPC cardsystems, Inc. A security vulnerability exists in OPC cardsystems Webapp Aufwertung version 2.1.0 that stems from a transaction reference that can be reused, potentially resulting in an improper transfer of funds...

WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by timomangcut in WordPress Plugin WP01 versions = 2.6.2...

WordPress plugin Contact Form & SMTP Plugin for WordPress by PirateForms 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Custom Script Integration plugin <= - 2.1 Cross Site Request Forgery (CSRF) Vulnerability

2.1 Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Custom Script Integration versions = 2.1...

WordPress Export and Import Users and Customers plugin <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter vulnerability

Authenticated Admin+ PHP Object Injection via formdata Parameter vulnerability discovered by HayMiz in WordPress Plugin Import Export WordPress Users versions = 2.6.2...

ruoyi-vue-pro 路径遍历漏洞

ruoyi-vue-pro is the Taro Road source code zhijiantianya open source an optimized and refactored efficient back-end management system framework for the development of enterprise back-end , SaaS platforms , WeChat applets back-end and so on. ruoyi-vue-pro 2.4.1 version of a path traversal...

CVE-2025-29312

An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct...

CVE-2025-29310

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...

CVE-2025-29311

CVE-2025-29311 affects ONOS v2.7.0, where a limited secret space in LLDP packets can let an attacker brute-force obtain the private key and craft LLDP packets. The public documents confirm the vulnerability and potential for exploit via crafted LLDP frames, but do not provide a concrete patch ver...

UBUNTU-CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

WordPress Simple Post Series plugin <= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Simple Post Series versions = 2.4.4...

SMF（Simple Machines Forum） 跨站脚本漏洞

SMF Simple Machines Forum is a free, open source community forum project by Simple Machines Open Source. A cross-site scripting vulnerability exists in SMF Simple Machines Forum version 2.1.4, which stems from improper manipulation of the Notice parameter in the ManageAttachments.php file, and...

CVE-2025-29412

A cross-site scripting XSS vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...

GHSA-4RQF-8PFM-P36R MLflow has a Local File Read/Path Traversal in dbfs

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

vLLM Deserialization of Untrusted Data vulnerability

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue,...

CVE-2025-1802

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘markertitle’, 'notificationcontent', and 'sttbuttontext' parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal enabling the deletion of files on the target server. An attacker can delete critical files such as polyaxon.sock to cause a crash of the API container. PoC python import requests url =...

CVE-2024-6838

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...