537 matches found
Revive Adserver: Authorization bypass allows changing email address of other users
The Revive Adserver 6.0.0 was found to have an authorization bypass vulnerability that allowed changing the email address of other users without requiring the account password. The vulnerability was present in the admin panel endpoint /admin/agency-user.php, which accepted a POST request that...
CVE-2025-60938
Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baudrate,...
CVE-2025-60938
CVE-2025-60938 affects Emoncms 11.7.3. The issue is a remote code execution in the firmware upload feature, arising from insufficient input validation of user-controlled parameters (filename, port, baud_rate, core, autoreset) in the /admin/upload-custom-firmware endpoint. When authenticated, an a...
CVE-2025-60938
Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baudrate,...
Improper Authentication
github.com/spectolabs/hoverfly is vulnerable to Improper Authentication. The vulnerability is due to the admin WebSocket endpoint /api/v2/ws/logs not being protected by the same authentication middleware as the REST admin API, which allows an unauthenticated remote attacker to access and stream...
CVE-2025-3930
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
CVE-2025-11171 Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter,...
EUVD-2019-18560
Malware in sbrugna...
EUVD-2018-19311
Malware in sbrugna...
EUVD-2021-13874
Malware in sbrugna...
EUVD-2018-2298
Malware in sbrugna...
EUVD-2025-31366
Malicious code in bioql PyPI...
EUVD-2025-31638
Malicious code in bioql PyPI...
EUVD-2022-53274
Malicious code in bioql PyPI...
EUVD-2022-52643
Malicious code in bioql PyPI...
EUVD-2025-28240
Malicious code in bioql PyPI...
EUVD-2024-36158
Malicious code in bioql PyPI...
EUVD-2022-32965
Malicious code in bioql PyPI...