Windows NTLMv2 Pass-the-hash

The vulnerability of the NTLMv2 authentication protocol for Windows operating systems is related to the disclosure of hashes due to improper external manipulation of the name or file. Exploiting this vulnerability can allow a remote attacker to execute a Pass-the-hash attack...

CVE-2024-47301

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bit Apps Bit Form bit-form allows Stored XSS.This issue affects Bit Form: from n/a through = 2.13.10...

CVE-2024-29138

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through = 2.5...

CVE-2024-49691

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WBW Plugins Product Filter by WBW woo-product-filter allows SQL Injection.This issue affects Product Filter by WBW: from n/a through = 2.7.0...

CVE-2024-1603

paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.readfile...

CVE-2024-1560

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the deleteartifactmlflowartifacts handler and localfileuritopath function, allowing for...

CVE-2024-54219

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through = 2.8.1...

CVE-2024-54350

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: from n/a through = 2.0...

CVE-2024-51631

Cross-Site Request Forgery CSRF vulnerability in Md Eftakhairul Islam Sticky Social Bar sticky-social-bar allows Cross Site Request Forgery.This issue affects Sticky Social Bar: from n/a through = 2.0...

CVE-2024-6983

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-4223

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete...

defaults security vulnerabilities

defaults is a library by the individual developer Nathan Houle. When the value of an enumerable property owned on a source object is undefined, copying that property from the source object to the target object A security vulnerability exists in defaults version v2.0.1, which stems from the lib.de...

F5 BIG-IP security vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in the F5 BIG-IP that originates when SNMP v1 or v2c is disabled and can be exploited by an...

CVE-2024-9644

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote...

CVE-2024-9644

CVE-2024-9644 affects the Four-Faith F3x36 router (firmware v2.0.0). The vulnerability is an authentication bypass in the administrative web server: certain admin functions are not protected when using bapply.cgi instead of apply.cgi. This allows a remote, unauthenticated attacker to modify setti...

CVE-2024-9643

CVE-2024-9643 concerns the Four-Faith F3x36 router with firmware version v2.0.0 , where an authentication bypass is caused by hard-coded credentials in the administrative web server . The description and connected sources confirm that an attacker who knows the credentials can gain administrative ...

Four-Faith F3x36 security vulnerabilities

The Four-Faith F3x36 is a portable wireless mobile router from Four-Faith China. A security vulnerability exists in the Four-Faith F3x36 version v2.0.0, which stems from the fact that certain administrative functions do not enforce authentication...

PT-2025-3731

Name of the Vulnerable Software and Affected Versions Four-Faith F3x36 router version 2.0.0 Description The issue is related to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via...

WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Prissy in WordPress Plugin Orbit Fox by ThemeIsle versions = 2.10.44...

CVE-2025-23491 WordPress VSTEMPLATE Creator plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator allows Reflected XSS.This issue affects VSTEMPLATE Creator: from n/a through = 2.0.2...