OpenEMR 代码问题漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A code issue vulnerability exists in versions prior to OpenEMR 7.0.3.1 that stems...

Drupal Cache Utility 跨站请求伪造漏洞

Drupal Cache Utility is a tool module for the Drupal community to manage and optimize the Drupal cache. A cross-site request forgery vulnerability exists in Drupal Cache Utility versions prior to 1.2.1 that stems from cross-site request forgery...

Drupal AI 操作系统命令注入漏洞

Drupal AI is a module or solution for the Drupal community that integrates artificial intelligence capabilities. An operating system command injection vulnerability exists in Drupal AI versions prior to 1.0.5, which stems from improper neutralization of a special element and could lead to os...

CVE-2024-10105

The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-20233

In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the chmod and makedirs Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-privileged user...

CVE-2025-26986

The CVE-2025-26986 entry concerns Pearl - Corporate Business WordPress theme (StylemixThemes). Affected component is PHP code handling include/require in the WordPress/PHP environment, enabling Local File Inclusion due to improper filename control, effectively a PHP Remote File Inclusion style is...

WordPress Slider by 10Web plugin < 1.2.62 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Slider by 10Web versions 1.2.62...

CVE-2024-13118

The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack...

CVE-2024-10638

The Product Labels For Woocommerce Sale Badges WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1452 Favorites < 2.3.5 - Admin+ Stored XSS

The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13123 AFI < 1.100.0 - Admin+ Stored XSS

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12682 Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS

The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-12805 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions prior to 1.51 Description: The issue concerns an information disclosure where users invited as "App Viewer" can access development information of a workspace, specifically getting a list of datasources. This does not expose...

AZL-77493 CVE-2025-30204 affecting package cf-cli for versions less than 8.4.0-27

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2025-1496

The CVE-2025-1496 entry concerns BG-TEK Coslat Hotspot with an improper restriction of excessive authentication attempts, enabling password brute forcing and authentication abuse. Affected product: Coslat Hotspot before version 6.26.0.R.20250227. Root cause described as insufficient protection ag...

anything-llm 输入验证错误漏洞

anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. An input validation error vulnerability exists in versions prior to anything-llm 1.2.2, which stems from the presence of Prisma injection in the API endpoint /embed/:embedId/stream-chat, which allows an...

CVE-2025-1232

The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks...

Absolute Secure Access 安全漏洞

Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A security vulnerability exists in Absolute Secure Access versions prior to 13.53, which stems from a cross-site scripting vulnerability in the Secure...

CODESYS Edge Gateway 安全漏洞

CODESYS Edge Gateway is an extended CODESYS gateway from CODESYS Germany used to connect CODESYS automation servers to CODESYS PLCs in a local network. A security vulnerability exists in CODESYS Edge Gateway versions prior to 3.5.21.0, which stems from the fact that an unauthenticated remote...

CVE-2025-1774

Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fields of the generated event. A field with additional field separator characters or values can be included in the "extraData" field.This issu...