4297 matches found
CVE-2025-30783
Cross-Site Request Forgery CSRF vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through = 16.0...
CVE-2024-12619 Insufficient Granularity of Access Control in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects...
CVE-2025-30890
CVE-2025-30890 is a PHP Local File Inclusion flaw in the WordPress plugin “Login Widget for Ultimate Member,” caused by improper filename handling in include/require paths. Affected: Login Widget for Ultimate Member (versions up to 1.1.2). Impact (as per CVSS metrics): attacker can read/modify/ex...
CVE-2025-30823
CVE-2025-30823 describes a Cross-Site Request Forgery (CSRF) vulnerability in Anthologize, affecting versions from unspecified n/a up to 0.8.2. The description confirms a CSRF flaw but provides no root-cause details beyond the generic CSRF label and does not supply exploit conditions, affected en...
CVE-2025-2600
Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATEDPASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24...
CVE-2025-30540
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through = 1.2...
Directus 信息泄露漏洞
Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. An information disclosure vulnerability exists in Directus versions prior to 9.0.0-alpha.4 through 11.5.0, which stems from the search parameter that can lead to unauthorized...
PT-2025-12984 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions 9.12.0 through 11.4.0 Description: Directus is a real-time API and App dashboard for managing SQL database content. When a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a...
WordPress plugin EZ SQL Reports Shortcode Widget and DB Backup 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Next.js 13.0.x < 13.5.9 Authorization Bypass
The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware. Note that the scanner has not attempted to...
AZL-59189 CVE-2025-30472 affecting package corosync 3.0.4-3
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet...
123-x-ed-eied (>=1.0.5, <=1.0.6), @0xdeepak/wallets (0.0.2) +617 more potentially affected by CVE-2025-29927 via next (>=12.0.0, <=12.3.4)
next NPM version =12.0.0, =1.0.5, =1.0.0, =1.1.1, =0.0.2-beta.0, =0.0.2-beta.0, =0.0.7, =0.0.0, =1.2.4, =3.6.2, =3.6.13 and more Source cves: CVE-2025-29927 Source advisory: OSV:GHSA-F82V-JWR5-MFFW...
GHSA-969W-GQQR-G6J3 MLflow Cross-Site Request Forgery (CSRF) vulnerability
A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...
adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +45 more potentially affected by CVE-2024-8501 via agentscope (>=0.1.0, <=2.0.6)
agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2024-8501 Source advisory: SNYK:PYTHON-AGENTSCOPE-9511413...
agentverse (0.1.8.1), airoboros (2.1.1) +34 more potentially affected by CVE-2024-10912 via fschat (>=0.2.2, <=0.2.36)
fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 and more Source cves: CVE-2024-10912 Source advisory: SNYK:PYTHON-FSCHAT-9553179...
CVE-2025-1473
In MLflow (mlflow/mlflow), a CSRF vulnerability affects versions 2.17.0 to 2.20.1 in the Signup feature, allowing an attacker to create a new account and potentially perform unauthorized actions on behalf of the attacker’s account. The CVE-2025-1473 entry documents the flaw and its impact as Cros...
@fibus-digital/sluby (>=0.4.15, <=0.4.32-beta3), @jsprismarine/client (>=0.12.1-unstable-20241211144608, <=0.12.2-unstable-20250317172708) +2 more potentially affected by CVE-2025-30144 via fast-jwt (>=5.0.0, <=5.0.5)
fast-jwt NPM version =5.0.0, =0.4.15, =0.12.1-unstable-20241211144608, =0.12.1-unstable-20241211144608, =0.12.1-unstable-20241211144608, =0.12.2-unstable-20250317172708 Source cves: CVE-2025-30144 Source advisory: OSV:GHSA-GM45-Q3V2-6CF8...
CVE-2024-49559
Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains an Use of Default Password vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2025-22472
Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to...