2312 matches found
CVE-2025-64142
A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...
Server Side Request Forgery (SSRF)
Ghost is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of user-supplied URLs, which allows an attacker to send crafted requests to internal resources and potentially access sensitive information...
PT-2025-44429
Name of the Vulnerable Software and Affected Versions PerfreeBlog version 4.0.11 Description The software contains a Server-Side Request Forgery condition resulting from a missing authorization check. This issue affects the uploadAttachByUrl API endpoint located in the AttachController.java file...
IBM Tivoli Monitoring 路径遍历漏洞
IBM Tivoli Monitoring is a set of system monitoring solutions introduced by IBM, mainly used for real-time monitoring of system performance, availability and application status in the enterprise IT environment. A path traversal vulnerability exists in IBM Tivoli Monitoring that stems from not...
CVE-2025-64139
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...
CVE-2025-64229
creationtimestamp| type| source ---|---|--- 2025-10-29 09:37:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m4d5k7qns62s...
Jenkins Start Windocks Containers Plugin 安全漏洞
Jenkins Start Windocks Containers Plugin is an open source plugin for Jenkins to link WinDocks hosts. A security vulnerability exists in Jenkins Start Windocks Containers Plugin 1.4 and earlier versions, which stems from a lack of privilege checking and could lead an attacker to connect to an...
CVE-2025-62778
Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL...
CVE-2025-34309
creationtimestamp| type| source ---|---|--- 2025-10-28 15:43:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115452557190111700...
CVE-2025-60358
creationtimestamp| type| source ---|---|--- 2025-10-27 22:15:23+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3m47gy6peop2e 2025-10-27 22:15:47+00:00| seen| https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3m47gybr2des2 2025-10-28 11:16:05+00:00| seen|...
EUVD-2025-36367
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting XSS via a malformed URL path. The 404 error page includes t...
CLSA-2025-1761576180 Fix CVE(s): CVE-2025-31651
SECURITY UPDATE: Bypassing of some rewrite rules by a specially crafted request - debian/patches/CVE-2025-31651.patch: better handling of URLs - CVE-2025-31651...
CVE-2025-12252
creationtimestamp| type| source ---|---|--- 2025-10-27 11:19:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m46cdhy2sz2c...
EUVD-2025-35904
The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input sanitization and output escaping when the "Save source URL" option is enabled. This makes it possible for unauthenticated...
WSO2 API Manager 安全漏洞
WSO2 API Manager is a suite of API lifecycle management solutions from US-based WSO2. A security vulnerability exists in WSO2 API Manager that stems from the Try-It feature not properly validating user-supplied URLs, which could lead to server-side request forgery and reflective cross-site...
CVE-2025-36361
creationtimestamp| type| source ---|---|--- 2025-10-24 13:06:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3wwvcpmv72f...
EUVD-2025-35803
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks...
PT-2025-43612
Name of the Vulnerable Software and Affected Versions Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress versions prior to 2.1.5 Description The software contains a Server-Side Request Forgery issue resulting from inadequate...
CVE-2025-62617
creationtimestamp| type| source ---|---|--- 2025-10-22 09:59:51+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33 2025-10-23 00:46:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3t53ouyh52o...