584 matches found
PT-2025-44066
Name of the Vulnerable Software and Affected Versions Campcodes Retro Basketball Shoes Online Store version 1.0 Description A flaw exists in Campcodes Retro Basketball Shoes Online Store 1.0 related to the file /admin/admin index.php. Manipulation of the Username argument can lead to a SQL...
PT-2025-43975
Name of the Vulnerable Software and Affected Versions ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System versions up to 1.1.0 Description A flaw exists in the Add Product Page component of the software, specifically affecting the file /admin/index.php?add product. This allows for...
Revive Adserver: Authorization bypass allows changing email address of other users
The Revive Adserver 6.0.0 was found to have an authorization bypass vulnerability that allowed changing the email address of other users without requiring the account password. The vulnerability was present in the admin panel endpoint /admin/agency-user.php, which accepted a POST request that...
CVE-2025-60938
Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baudrate,...
CVE-2025-60938
Emoncms version 11.7.3 is vulnerable to remote code execution (RCE) due to insufficient input validation in its firmware upload feature. Authenticated users can exploit this by sending unsanitized parameters—including filename, port, baud_rate, core, and autoreset—to the /admin/upload-custom-firm...
CVE-2025-60938
Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baudrate,...
Improper Authentication
github.com/spectolabs/hoverfly is vulnerable to Improper Authentication. The vulnerability is due to the admin WebSocket endpoint /api/v2/ws/logs not being protected by the same authentication middleware as the REST admin API, which allows an unauthenticated remote attacker to access and stream...
CVE-2025-3930
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
CVE-2025-11171 Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter,...
EUVD-2019-18560
Malware in sbrugna...
EUVD-2018-19311
Malware in sbrugna...
EUVD-2021-13874
Malware in sbrugna...
EUVD-2018-2298
Malware in sbrugna...
EUVD-2022-52643
Malicious code in bioql PyPI...
EUVD-2022-53274
Malicious code in bioql PyPI...
EUVD-2025-31366
Malicious code in bioql PyPI...
EUVD-2025-31638
Malicious code in bioql PyPI...
EUVD-2022-32965
Malicious code in bioql PyPI...