95 matches found
CVE-2025-32676 WordPress Verowa Connect plugin <= 3.0.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Blind SQL Injection.This issue affects Verowa Connect: from n/a through = 3.0.5...
CVE-2025-32181 WordPress Search, Filters & Merchandising for WooCommerce plugin <= 3.0.57 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fast Simon Search, Filters & Merchandising for WooCommerce allows Stored XSS. This issue affects Search, Filters & Merchandising for WooCommerce: from n/a through 3.0.57...
CVE-2025-30521 WordPress GP Back To Top plugin <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in giangmd93 GP Back To Top allows Cross Site Request Forgery. This issue affects GP Back To Top: from n/a through 3.0...
CVE-2025-25747
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint...
CVE-2025-27146 Matrix IRC Bridge allows IRC command injection to own puppeted user
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability h...
ModSecurity 安全漏洞
ModSecurity is an open source, cross-platform web application firewall WAF engine from OWASP ModSecurity Open Source. A security vulnerability exists in ModSecurity version 3.0.13, which stems from an inability to decode encoded HTML entities containing leading zeros...
PT-2025-6758 · Ixon B.V. · Ixrouter Ix2400
Name of the Vulnerable Software and Affected Versions: IXON B.V. IXrouter IX2400 Industrial Edge Gateway version 3.0 Description: The issue concerns hardcoded root credentials stored in the non-volatile flash memory. This allows physically proximate attackers to gain root access via UART or SSH...
Astra Linux – Vulnerability in Waitress
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before Waitress has had the opportunity to call getpeername, Waitress will not properly clean up the connection. As a result, the main thread attempts to write to a socket that no long...
WordPress File Manager Plugin < 3.0 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webdesi9:filemanager"; if description...
CVE-2024-27284
cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...
CVE-2024-57720
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovgblend...
CVE-2024-11816
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpexthandlesnippetupdate' function. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-36775
A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page...
PT-2023-30981 · Unknown · Appointment Scheduler
Name of the Vulnerable Software and Affected Versions: Appointment Scheduler version 3.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or Default Country Code. Recommendations: For Appointment Scheduler version 3.0, consider...
WordPress Plugin CITS Support svg, webp Media and TTF,OTF File Upload Cross Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin CITS Support svg, webp Med...
CVE-2023-43374
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php...
UBUNTU-CVE-2023-36250
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record...
vsftpd 安全漏洞
vsftpd is an FTP File Transfer Protocol server for Unix-like systems. A security vulnerability exists in vsftpd version 3.0.3, which originated from allowing an attacker to cause a denial of service due to a limited number of allowed connections...
JerryScript 安全漏洞
JerryScript is a lightweight JavaScript engine from the Jerryscript Project. A security vulnerability exists in JerryscriptProject jerryscript version v.3.0.0. An attacker exploited the vulnerability to obtain sensitive information via a specially crafted array script...