PT-2025-5745

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 4.3.1 Description: The issue concerns a stored cross-site scripting XSS vulnerability in the iOS Dynamic Analyzer functionality of the Mobile Security Framework MobSF. According to Apple's...

CVE-2024-53999

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to th...

CVE-2025-22205

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x...

CVE-2025-22205

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x...

WordPress plugin DSGVO All in one for WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress CM Tooltip Glossary plugin <= 4.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis Patchstack Alliance in WordPress Plugin CM Tooltip Glossary versions = 4.4.1...

ClassCMS 安全漏洞

ClassCMS is a simple, flexible, secure and easy to expand content management system from China ClassCMS open source. A security vulnerability exists in ClassCMS version 4.8, which stems from a code execution vulnerability that allows an attacker to execute arbitrary code by constructing a payload...

Prolink DL-7203E 安全漏洞

The Prolink DL-7203E is a wireless router from Prolink USA. A security vulnerability exists in the Prolink DL-7203E version V4.0.0B05, which stems from vulnerability to cross-site scripting XSS attacks that allow the browser to execute injected JavaScript code...

ClassCMS 安全漏洞

ClassCMS is a simple, flexible, secure and easy-to-expand content management system from China ClassCMS open source. A security vulnerability exists in ClassCMS version 4.8, which stems from vulnerability to cross-site scripting attacks...

CVE-2024-13341

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all versions up to, and including, 4.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - Multiple Broken Access Control vulnerability

Multiple Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Accessibility Suite versions = 4.18...

WordPress AI Infographic Maker plugin <= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Infographic Maker – iList versions = 4.9.0...

PT-2025-2242 · WordPress · Music Sheet Viewer

Name of the Vulnerable Software and Affected Versions: Music Sheet Viewer plugin for WordPress versions up to and including 4.1 Description: The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, through the read...

CVE-2024-57438

Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...

CVE-2025-0353 Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. Th...

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()

...

nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net

...

Apache Hive Incorrectly Assigns Permissions for a Critical Resource

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to...

CVE-2024-57439

An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.8.0, which stems from a problem with the reset password screen that allows an attacker with administrator privileges to cause a denial of service by copying the login name...