4647 matches found
PT-2025-34027 · Mir · Mir
Name of the Vulnerable Software and Affected Versions: MiR software versions prior to 3.0.0 Description: MiR software versions prior to 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes intended only for administrative users...
CVE-2025-9146
A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verifygemtekheader of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. The attack requires a high leve...
CVE-2025-51540
EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5md5password. This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm make...
CVE-2025-8357
The CVE-2025-8357 entry concerns the WordPress plugin Media Library Assistant. It describes a vulnerability in versions up to 3.27 where insufficient file path validation and inadequate user-capability checks in the _process_mla_download_file function allow authenticated users with Author-level a...
PT-2025-33714
Name of the Vulnerable Software and Affected Versions: Cloudflare Image Resizing plugin for WordPress versions up to and including 1.5.6 Description: The Cloudflare Image Resizing plugin for WordPress is susceptible to Remote Code Execution RCE due to missing authentication and insufficient...
Linux Distros Unpatched Vulnerability : CVE-2024-10603
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in som...
Linux Distros Unpatched Vulnerability : CVE-2023-47039
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell cmd.exe...
CVE-2025-54336
In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...
Amazon Linux 2 : perl-Authen-SASL (ALAS-2025-2967)
The version of perl-Authen-SASL installed on the remote host is prior to 2.15-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2967 advisory. Authen::SASL::Perl::DIGESTMD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce client non...
Linux Distros Unpatched Vulnerability : CVE-2021-24116
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secre...
CVE-2025-8089 Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
PT-2025-33529 · WordPress · Earnware Connect
Name of the Vulnerable Software and Affected Versions: Earnware Connect versions prior to 1.0.74 Description: The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew hasrole shortcode due to insufficient input sanitization and output escaping on...
Linux Distros Unpatched Vulnerability : CVE-2025-3576
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum desig...
CVE-2025-40758
CVE-2025-40758 concerns the Mendix SAML module. Affected: Mendix SAML (Mendix 10.12 compatible) < 4.0.3; Mendix SAML (Mendix 10.21 compatible) < 4.1.2; Mendix SAML (Mendix 9.24 compatible)
CVE-2025-54679 WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability
Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Neon Channel Product Customizer Free: from n/a through 2.0...
CVE-2025-50040 WordPress CF7 Spreadsheets Plugin <= 2.3.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through = 2.3.2...
CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...
Tenda G1 数据伪造问题漏洞
Tenda G1 is an Enterprise Ap Management Router from Tenda China. A data forgery issue vulnerability exists in Tenda G1 version 16.01.7.83660, which stems from insufficient data authenticity validation of the function checkuploadfile in the firmware update processing component...
Cisco Secure Firewall Management Center 命令注入漏洞
Cisco Secure Firewall Management Center is a powerful network security management tool from Cisco. A command injection vulnerability exists in Cisco Secure Firewall Management Center that stems from insufficient validation of HTTP request parameters and could lead to the execution of arbitrary...
IBM WebSphere Application Server 8.5.x < 8.5.5.29 / 9.x < 9.0.5.25 (7242172)
The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7242172 advisory. - IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. CVE-2025-33142 Note that Nessus has not...