PT-2025-9102 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in "/account/login" API endpoint. This could potentially lead to...

Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

Impact An unauthenticated stack overflow crash, leading to a denial of service DoS, was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would...

PT-2025-9095 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions 2.8.0 through 2.8.12 Rancher versions 2.9.0 through 2.9.6 Rancher versions 2.10.0 through 2.10.2 Description: A Stack-based Buffer Overflow vulnerability in SUSE Rancher allows for denial of service. This issue affects...

The vulnerability of the ‘c_only_fields’ parameter in the REST API endpoint /wp-json/learnpress/v1/courses of the LearnPress plugin for the WordPress content management system allows a hacker to execute arbitrary SQL code.

The vulnerability of the ‘conlyfields’ parameter in the REST API endpoint /wp-json/learnpress/v1/courses of the LearnPress plugin for the WordPress content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow a...

PT-2025-7121 · Unknown · Feminer Wms

Name of the Vulnerable Software and Affected Versions: FeMiner WMS version 1.0 Description: The issue allows a remote attacker to obtain sensitive information. This is achieved via the itemid parameter. Recommendations: For FeMiner WMS version 1.0, avoid using the parameter itemid in the affected...

CVE-2025-0526

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows...

CVE-2025-0526

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows...

CVE-2025-0526

CVE-2025-0526 affects Octopus Deploy. The issue arises from a lack of input validation in an API endpoint that permits uploading files to unexpected locations on the host, potentially enabling circumvention of intended workflows. Connected sources confirm the vulnerability description across mult...

CVE-2025-0526

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows...

Octopus Server 安全漏洞

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. A security vulnerability exists in Octopus Server that stems from the ability to upload files to an unexpected location on the host using an API endpoint...

PT-2025-5975 · Nextu · Nextu Fleta Ax1500 Wifi6

Name of the Vulnerable Software and Affected Versions: NEXTU FLETA AX1500 WIFI6 version 1.0.3 Description: A buffer overflow was discovered at the /boafrm/formIpQoS API endpoint. This issue allows attackers to cause a Denial of Service DoS or potentially execute arbitrary code via a crafted POST...

CVE-2022-3708

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

PT-2025-5840 · Douphp · Douphp

Name of the Vulnerable Software and Affected Versions: DouPHP version 1.8 Release 20231203 Description: The issue allows attackers to execute arbitrary code via a crafted payload injected into the description parameter in "/admin/article.php" API endpoint. This enables attackers to perform...

PT-2025-5883 · Mindskip · Mindskip Xzs-Mysql 学之思开源考试系统

Name of the Vulnerable Software and Affected Versions: Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0 Description: A problematic issue has been found in the Exam Edit Handler component. The manipulation of the title and content arguments in the "/api/admin/question/edit" API endpoint leads to...

CVE-2022-24848

DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the /api/programs/orgUnits?programs= API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from...

CVE-2020-5244

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2...

CVE-2024-7743

A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attac...

CVE-2024-7742

A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch...

CVE-2024-3283

A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multiusermode' system variable, enabling...

CVE-2024-29192

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...