CVE-2025-27659

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002...

CVE-2025-27667

Vasion Print (formerly PrinterLogic), a SaaS-based application for managing and deploying printers, is vulnerable to Administrative User Email Enumeration in versions prior to Virtual Appliance Host 22.0.843 and Application 20.0.1923 . The underlying cause is an Observable Discrepancy (CWE-203) t...

CVE-2025-26318

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application...

CVE-2025-26318

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application...

CVE-2025-26318

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application...

CVE-2025-1872

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.php...

CVE-2024-13697

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nicelinks'. This makes it possible for unauthenticated attackers to make web request...

CVE-2025-27554

ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server e.g., read secrets from the desktopify config.prod.json file, and consequently deploy updates to any app, via a postinstall script in...

CVE-2025-20049 Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site Scripting

The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

PT-2025-7637 · Unknown · Application

Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The issue concerns the lack of authorization checks for the Host parameter, allowing unauthorized access to view profile information of other users. An attacker can exploit this by...

CVE-2024-13538

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This is due the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering an error. This makes it possible f...

CVE-2025-22622 Age Verification - Reflected cross-site scripting (XSS)

Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php...

CVE-2025-22622

CVE-2025-22622 : WordPress Age Verification plugin for checkout (Age Verification for your checkout page / agecheckernet, version

CVE-2025-22622 Age Verification - Reflected cross-site scripting (XSS)

Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php...

IBM Aspera Shares Input Validation Error Vulnerability

IBM Aspera Shares is a Web application from International Business Machines IBM. An input validation error vulnerability exists in IBM Aspera Shares, which stems from improper validation of the "Client-IP" header, and can be exploited by an attacker to spoof its IP address written to a log file...

CVE-2025-25297

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a cust...

CVE-2025-25201

Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the...

CVE-2025-1298

A logic vulnerability exists in the com.transsion.carlcare mobile application, which is provided by Transsion (TECNO) . This flaw could allow for an account takeover . While the root cause is identified as flawed logic, specific technical details regarding the underlying component or precise expl...