Koha 操作系统命令注入漏洞

Koha is a Koha organization's system for automated library administration building. A security vulnerability exists in Koha versions prior to 24.11.02, which stems from an administrator being able to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service

...

Libxslt 资源管理错误漏洞

Libxslt is a Libxslt open source XSLT C library developed for the GNOME project. A security vulnerability exists in versions of Libxslt prior to 1.1.43 that stems from a post-release reuse issue...

AZL-58413 CVE-2025-22870 affecting package prometheus-process-exporter for versions less than 0.8.2-2

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58440 CVE-2025-22870 affecting package telegraf for versions less than 1.29.4-15

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

1E Client 安全漏洞

1E Client is an agent-less endpoint management software from 1E Client USA. A security vulnerability exists in 1E Client versions prior to 25.3 that stems from improper link resolution prior to file access, which could allow a local attacker to delete arbitrary files...

Ratify 授权问题漏洞

Ratify is an artifact approval framework CNCF sandbox from Ratify open source. An authorization issue vulnerability exists in Ratify version 1.2.3 and prior to version 1.3.2 that stems from the Azure Authentication Provider not verifying that the target registry is ACR, which could lead to misuse...

AZL-58362 CVE-2025-2137 affecting package nodejs for versions less than 24.14.1-3

Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

Tap&Sign 安全漏洞

Tap&Sign is an easy-to-use, legally binding electronic signature solution from Tap&Sign, Inc. A security vulnerability exists in Tap&Sign versions prior to V.1.025 that stems from sensitive information stored in plaintext in an environment variable and a weak password recovery mechanism that coul...

picklescan 数据伪造问题漏洞

picklescan is a security scanning program by the individual developer Matthieu Maitre. A data forgery issue vulnerability exists in picklescan versions prior to 0.0.23, which stems from a ZIP file manipulation that may cause a crash, thereby bypassing malicious payload detection...

UBUNTU-CVE-2025-27796

ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob...

Axios 代码问题漏洞

Axios is an HTTP client based on Promise a solution for asynchronous programming from the Axios open source. A code issue vulnerability exists in Axios versions prior to 1.8.2 that stems from passing absolute URLs could lead to SSRF and credential disclosure...

CVE-2025-0877 XSS in AtaksAPP's Reservation Management System

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting XSS. This issue affects Reservation Management System: before 4.2.3...

WordPress WooCommerce Recover Abandoned Cart plugin < 24.5.0 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Plugin WooCommerce Recover Abandoned Cart versions 24.5.0...

CVE-2024-9149

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5...

CVE-2024-50705

Unauthenticated reflected cross-site scripting XSS vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts via the page parameter...

CVE-2024-9149 SQLi in Wind Media's E-Commerce Website Template

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5...

CVE-2024-9149 SQLi in Wind Media's E-Commerce Website Template

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5...

WordPress Edd Google Sheet Connector Pro plugin < 1.4 - Cross-Site Request Forgery to Access Code Update vulnerability

Cross-Site Request Forgery to Access Code Update vulnerability discovered by Erwan LR in WordPress Plugin Edd Google Sheet Connector Pro versions 1.4...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 136, which stems from privilege grant spoofing...