PT-2025-48369

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has...

PT-2025-48367

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7 Description OrangeHRM does not invalidate existing sessions when a user is disabled or a password change occurs, allowing active session cookies to remain valid indefinitely. This allows a disabled user, or a...

PT-2025-48368

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no...

CVE-2025-11933

CVE-2025-11933 describes an issue in wolfSSL up to version 5.8.2 where improper input validation in the TLS 1.3 CKS extension parsing can allow a remote unauthenticated attacker to cause a denial‑of‑service with a crafted ClientHello containing duplicate CKS extensions. Affected software is wolfS...

编号撤回

Official Clerk JavaScript SDKs is a Clerk open source official Javascript repository for Clerk authentication. A security vulnerability exists in the Official Clerk JavaScript SDKs version 5.88.0 that originates from an attacker being able to bypass the OAuth authentication process, potentially...

PT-2025-44799

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.7 Description Nagios XI versions prior to 5.8.7, utilizing embedded Nagios Core, are susceptible to cross-site scripting XSS through the Core UI’s Views URL handling. Insufficient validation or escaping of...

CVE-2021-47697 Nagios XI < 5.8.0 XSS via Views URL Handling

Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting XSS via the Views feature URL handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2021-47692

CVE-2021-47692 is a duplicate of CVE-2021-33179 and is rejected as a separate entry. The connected Red Hat and NVD records describe Nagios XI general UI versions prior to 5.8.4 as vulnerable to authenticated reflected cross-site scripting (XSS). An authenticated user who visits a crafted URL coul...

PT-2025-44552

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.0 Description Nagios XI versions prior to 5.8.0 are susceptible to cross-site scripting XSS through the Views feature's URL handling. Insufficient validation or escaping of user-supplied input could allow an...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI versions prior to 5.8.0 that stems from insufficient validatio...

PT-2025-44550

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.0 Description The software is susceptible to stored cross-site scripting XSS through the My Tools page. Insufficient validation or escaping of user-supplied input could allow an attacker to inject and execute...

CVE-2024-56804

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later...

CVE-2024-56804

Video Station is affected by an SQL injection vulnerability (CVE-2024-56804). The issue requires an attacker who has already gained a user account to trigger SQL injection and execute unauthorized code or commands on the system. The vulnerability exists in versions prior to 5.8.4 and has been fix...

CVE-2024-56804 Video Station

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later...

PT-2025-40543

Name of the Vulnerable Software and Affected Versions Video Station versions prior to 5.8.4 Description An SQL injection issue exists in Video Station. A remote attacker who has obtained a user account can potentially execute unauthorized code or commands. Recommendations Update to Video Station...

PT-2025-40429

Name of the Vulnerable Software and Affected Versions Traccar versions 5.8 through 6.0 Traccar versions 6.1 through 6.8.1 Description Traccar, an open source GPS tracking system, has a flaw that allows for unauthenticated local file inclusion attacks. This can result in the disclosure of password...

Scontain SCONE 安全漏洞

Scontain SCONE is a secure container environment from Scontain. A security vulnerability exists in Scontain SCONE version 5.8.0, which stems from the presence of an interface vulnerability that can lead to state corruption via injection signals...

WordPress plugin MP3 Audio Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin ProfileGrid 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Rapid SCADA 安全漏洞

Rapid SCADA is a full-featured SCADA software from Rapid SCADA Open Source. A security vulnerability exists in Rapid SCADA version 5.8.4, which originates in the file ScadaServerEngine/MainLogic.cs where CheckUser allows the use of empty passwords...