CVE-2025-1467

Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting XSS via the getElemWidth and getElemHeight. This is related to SNYK-JS-TARTEAUCITRONJS-8366541...

IBM Watson Query 安全漏洞

IBM Watson Query is a general purpose query engine from International Business Machines IBM. It can execute distributed and virtualized queries across databases, data warehouses, data lakes, and streaming data without additional manual changes, data movement, or replication. A security...

WordPress plugin A1POST.BG Shipping for Woo 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations...

Devolutions Server < 2024.3.11.0 Improper Password Reset (DEVO-2025-0002)

The version of Devolutions Server installed on the remote host is prior to 2024.3.11.0 and is, therefore, affected by an improper password reset vulnerability: - Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle us...

CVE-2025-25765

CVE-2025-25765 affects MRCMS v3.1.2, with a vulnerability in the /file/save.do component that permits arbitrary file write. Descriptions collected across multiple feeds consistently name the affected product and the vulnerable endpoint, indicating an impact on the ability to write files locally. ...

CVE-2024-37362 Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. CWE-522 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database...

CVE-2025-25196 OpenFGA Authorization Bypass

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.4 Helm chart openfga-0.2.22, docker v.1.8.4 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users on OpenFGA...

CVE-2025-23085 affecting package nodejs for versions less than 20.14.0-5

CVE-2025-23085 affecting package nodejs for versions less than 20.14.0-5. A patched version of the package is available...

CVE-2024-13534 Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection

The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 5.2.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

Oracle Agile Product Lifecycle Management (PLM) 9.3.6.x < 9.3.6.28.3 (CVE-2024-21287)

The version of Oracle Agile Product Lifecycle Management PLM on the remote host is 9.3.6.x prior to 9.3.6.28.3. It is, therefore, affected by an unauthenticated remote file disclosure vulnerability: - Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain component: Softwa...

Wireshark 4.2.x < 4.2.11 / 4.4.x < 4.4.4 DoS Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 4.2.11 or 4.4.4. It is, therefore, affected by a vulnerability as referenced in the wireshark-4.2.11 advisory. - The Bundle Protocol and CBOR dissectors could crash. Fixed in master: 83c73a83ad Fixed in release-4.4:...

CVE-2024-13523

CVE-2024-13523 pertains to the MemorialDay WordPress plugin. The Wordfence entry confirms a CSRF to Stored XSS issue affecting all versions up to 1.0.4, caused by missing or incorrect nonce validation on a function. This enables unauthenticated attackers to alter settings and inject malicious scr...

CVE-2025-25222

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

Joomla 4.1.x < 4.4.11 / 5.0.x < 5.2.4 Joomla 5.2.4 Security & Bugfix Release (5920-joomla-5-2-4-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.1.x prior to 4.4.11 or 5.0.x prior to 5.2.4. It is, therefore, affected by a vulnerability. - Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of...

BIT-GITLAB-2024-8266 Execution with Unnecessary Privileges in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances...

CVE-2024-13834 Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request

The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remoterequest' function. This makes it possible for authenticated attacker...

CVE-2025-23431

CVE-2025-23431 describes a reflected cross-site scripting vulnerability in the WordPress plugin Envato Affiliater (NotFound) affecting versions up to 1.2.4. The entry lists a NotFound Envato Affiliater component as vulnerable, with a CVSS v3.1 base score of 7.1 (High) and an attack vector of Netw...

CVE-2024-34448

Ghost before 5.82.0 allows CSV Injection during a member CSV export...

PT-2025-7032 · WordPress · Wp Mailster

Name of the Vulnerable Software and Affected Versions: WP Mailster versions 1.8.20.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...