CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

novel-plus 安全漏洞

novel-plus is a novel reading software by xxy individual developer. A security vulnerability exists in novel-plus 5.1.3 and earlier versions, which stems from the mishandling of the parameter sort/order in the user management module, which may lead to an SQL injection attack...

Mitel OpenScape Accounting Management 安全漏洞

Mitel OpenScape Accounting Management is an application for managing and tracking communication costs from Mitel Canada. A security vulnerability exists in Mitel OpenScape Accounting Management V5 R1.1.0 and earlier versions, which stems from insufficient user input cleanup leading to a path...

PYSEC-2025-37

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.striptags function is vulnerable to a potential denial-of-service slow performance when processing inputs containing large sequences of incomplete HTML tags. The template filter...

Drupal Enterprise MFA - TFA for Drupal module < 4.7.0,5.0.0-5.1.0 - Unauthenticated Broken Access Control vulnerability

Drupal Enterprise MFA - TFA for Drupal module 4.7.0,5.0.0-5.1.0 - Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module Enterprise MFA - TFA for Drupal versions 4.7.0,5.0.0-5.1.0...

CVE-2025-3856 xxyopen Novel-Plus searchByPage sql injection

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-27692

Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution...

WordPress Essential Real Estate plugin <= 5.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das in WordPress Plugin Essential Real Estate versions = 5.1.8...

WordPress plugin Taxonomy/Term and Role based Discounts for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...

WordPress AdForest theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post/Attachment Deletion vulnerability discovered by Lucio Sá in WordPress Theme AdForest versions = 5.1.7...

WordPress plugin Essential Real Estate 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

OroPlatform 安全漏洞

OroPlatform is an Oro open source PHP Business Application Platform BAP designed to make custom business application development easier and faster. A security vulnerability exists in OroPlatform version v5.1, which stems from vulnerability to cross-site scripting attacks, where an attacker can...

WordPress plugin Bold Page Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

GHSA-5HGC-2VFP-MQVC Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters...

WordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Bold Page Builder versions = 5.1.1...

CVE-2023-37230

Loftware Spectrum testDeviceConnection before 5.1 allows SSRF...

CVE-2023-37230

Loftware Spectrum testDeviceConnection before 5.1 allows SSRF...

PT-2024-28538

Name of the Vulnerable Software and Affected Versions Dell PowerScale InsightIQ versions 5.0 through 5.1 Description The issue is related to an Improper Access Control vulnerability. A high-privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of...

PT-2024-25269 · Espressif · Esp-Idf

Name of the Vulnerable Software and Affected Versions: esp-idf version 5.1 Description: A Buffer Overflow issue allows a remote attacker to obtain sensitive information via the externalId component. Recommendations: For esp-idf version 5.1, at the moment, there is no information about a newer...