EUVD-2025-27285

Malicious code in bioql PyPI...

EUVD-2025-27570

Malicious code in bioql PyPI...

EUVD-2025-27649

Malicious code in bioql PyPI...

EUVD-2022-48178

Malicious code in bioql PyPI...

EUVD-2022-26868

Malicious code in bioql PyPI...

EUVD-2022-43260

Malicious code in bioql PyPI...

EUVD-2025-10543

Malicious code in bioql PyPI...

EUVD-2024-44015

Malicious code in bioql PyPI...

EUVD-2025-0038

Malicious code in bioql PyPI...

EUVD-2025-31024

Malicious code in bioql PyPI...

EUVD-2025-31607

Malicious code in bioql PyPI...

EUVD-2022-37867

Malicious code in bioql PyPI...

Duplicate Advisory: motionEye vulnerable to RCE via unsanitized motion config parameter

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j945-qm58-4gjx. This link is maintained to preserve external references. Original Description MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as imagefilenam...

EUVD-2025-32369

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

CVE-2025-60449

An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the adminsafe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also...

CVE-2025-10053 TableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-9333 Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2025-60449

An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the adminsafe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also...

CVE-2025-60787

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as imagefilename. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted...

CVE-2025-20361

CVE-2025-20361 describes a stored cross-site scripting vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The issue arises from improper validation of user-supplied input in the inter...