Static Web Server security vulnerabilities

Static Web Server is a static web server from the German company Static Web Server. A security vulnerability exists in Static Web Server version 2.40.0 and earlier, which stems from improper handling of symbolic links and could lead to a directory traversal attack...

WordPress plugin My Tickets has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

OpenBMCS code-related vulnerabilities

OpenBMCS is a building management and control system from OpenBMCS Australia. A code issue vulnerability exists in OpenBMCS version 2.4 that stems from a server-side request forgery issue with the ip parameter, which could lead to internal network enumeration and session hijacking...

OpenBMCS SQL Injection Vulnerability

OpenBMCS is a building management and control system from OpenBMCS Australia. A SQL injection vulnerability exists in OpenBMCS version 2.4, which stems from a SQL injection issue with the id parameter that could lead to the disclosure of database information...

OpenBMCS Cross-Site Request Forgery Vulnerability

OpenBMCS is a building management and control system from OpenBMCS Australia. A cross-site request forgery vulnerability exists in OpenBMCS version 2.4, which stems from a cross-site request forgery issue in the sendFeedback.php endpoint that could lead to the execution of an administrator action...

OpenBMCS security vulnerabilities

OpenBMCS is a building management and control system from OpenBMCS Australia. A security vulnerability exists in OpenBMCS version 2.4, which stems from a privilege manipulation issue in the updateuserpermissions.php script that could lead to elevated privileges...

WordPress Plugin Wp Ultimate Review: Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin WP Google Analytics Events security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress plugin Yandex Delivery (Boxberry) has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A security...

WordPress plugin Sitewide Notice: WP security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin Sitewide Notice A...

EUVD-2025-201820

ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login...

EUVD-2025-201821

ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login...

GHSA-7WFC-4796-GMG5 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

Summary Zitadel is vulnerable to an unauthenticated, full-read SSRF vulnerability. An unauthenticated remote attacker can force Zitadel into making HTTP requests to arbitrary domains, including internal addresses. The server then returns the upstream response to the attacker, enabling data...

CVE-2025-42615

Summary: CVE-2025-42615 affects Vulnerability-Lookup prior to 2.18.0 and stems from failing to rate-limit OTP attempts during 2FA, enabling brute-force style OTP submissions by an attacker with valid credentials. The concrete fix adds a persistent failed_otp_attempts counter, locks a user after 5...

UBUNTU-CVE-2023-53763

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: fix to do sanity check on extent cache correctly" syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for type 'le32923' aka 'unsigned int923' Ca...

CVE-2023-53763

CVE-2023-53763 relates to a Linux kernel issue in the F2FS file system where a UBSAN array-index-out-of-bounds occurs during inode/extent cache processing (fs/f2fs/f2fs.h:3275). The symptom traces to a do_read_inode path, with index 1409 out of range for an unsigned int[923] during inline status ...

smb/server: fix possible memory leak in smb2_read()

...

CVE-2025-14199

Verysync up to 2.21.3 is affected in the Web Administration Module via the file path /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false, where manipulation can lead to unrestricted file upload. The vulnerability can be exploited remotely and an exploit has been published. Affected...

Sobey Media Convergence System path traversal vulnerability

The Sobey Media Convergence System is a media convergence system from the Chinese company Sobey. A path traversal vulnerability exists in Sobey Media Convergence System versions 2.0 and 2.1, which can be caused by incorrect manipulation of the File parameter in the file...

EUVD-2025-201518

The Yet Another WebClap for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter of the webclapbutton shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for...