2739 matches found
CVE-2024-12133 affecting package libtasn1 for versions less than 4.19.0-2
CVE-2024-12133 affecting package libtasn1 for versions less than 4.19.0-2. A patched version of the package is available...
BIT-MYSQL-CLIENT-2023-52970
MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4. crashes in Itemdirectviewref::derivedfieldtransformerforwhere...
CVE-2025-1119
CVE-2025-1119 affects the WordPress plugin “Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin” and allows unauthenticated attackers to execute arbitrary shortcodes via an improper validation of values before running do_shortcode. The issue impacts all versions up to and i...
CVE-2024-12380
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication...
CVE-2024-7296
GitLab EE contains CVE-2024-7296: affected releases are 16.5 up to 17.7.7, 17.8 up to 17.8.5, and 17.9 up to 17.9.2. A user with a custom permission could approve pending membership requests beyond the configured cap, potentially granting access beyond allowed users. This is described across mult...
CVE-2024-12380 Generation of Error Message Containing Sensitive Information in GitLab
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication...
WordPress Elementor Pro Animation Addon 1.6 Missing Authorization Exploit
import argparse import requests from bs4 import BeautifulSoup import re Exploit By Nxploit Khaled ALenazi def loginsession, url, username, password, useragent: loginurl = url + '/wp-login.php' response = session.postloginurl, verify=False, data= 'log': username, 'pwd': password, 'rememberme':...
CVE-2025-29904
In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible...
Apache Tomcat 10.1.0-M1 < 10.1.35 Remote Code Execution
The version of Apache Tomcat installed on the remote host is 9.0.0-M1 to 9.0.98, 10.1.0-M1 to 10.1.34 or 11.0.0-M1 to 11.0.2. It is, therefore, affected by a remote code execution and/or an information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet...
CVE-2025-2169 WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running...
Kibana 8.x < 8.11.2 Insertion of Sensitive Information into Log File
According to its self-reported version number, the Kibana application running on the remote host is 7.13.x prior to 7.17.16 or 8.x prior to 8.11.1. It is, therefore, affected by an issue that can log sensitive information in Kibana logs in the event of an error or in the event where debug level...
GHSA-83WP-F5C3-HQQR Laravel framework susceptible to reflected cross-site scripting
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page...
Laravel framework susceptible to reflected cross-site scripting
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page...
CVE-2025-27925
Nintex Automation versions 5.6 and 5.7, prior to 5.8, are affected by insecure deserialization of user input. The CVE-2025-27925 entry describes a vulnerability in Nintex Automation with impact across confidentiality, integrity, and availability (per CVSS scores: high- to critical-severity ranges...
Apache Tomcat 10.1.0.M1 < 10.1.35
The version of Tomcat installed on the remote host is prior to 10.1.35. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.35security-10 advisory. - Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure...
CVE-2025-1322 WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated...
CVE-2025-27675
Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004...
CVE-2025-2045 Incorrect Authorization in GitLab
Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access to potentially sensitive project analytics data...