1644 matches found
CVE-2025-56313: Improper Neutralization of Input During Web Page Generation
A Reflected Cross-Site Scripting XSS vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 inclusive. This allows remote attackers to execute arbitrary JavaScript in a user's web browser by including a malicious payload in the "code" URL parameter. When an...
CVE-2025-4106
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command. This issue affects Fireware OS: from 12.0...
Linux Distros Unpatched Vulnerability : CVE-2025-57567
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory...
CVE-2025-4106 WatchGuard Firebox leftover debug code vulnerability
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command...
CVE-2025-4106
CVE-2025-4106 is a vulnerability in WatchGuard Fireware OS where an authenticated admin who has access to both the WebUI and the CLI can enable a diagnostic debug shell by uploading a platform/version-specific diagnostic package and executing a leftover diagnostic command. Affected versions are F...
CVE-2025-1679
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...
CVE-2025-11889 AIO Forms <= 1.3.15 - Authenticated (Admin+) Arbitrary File Upload via Zip Import
The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.15. This makes it possible for authenticated attackers, with Administrator-level access...
CVE-2025-4106: Active Debug Code
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command...
CVE-2025-1679
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...
CVE-2025-1679
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...
CVE-2025-1679
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...
EUVD-2025-35687
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...
CVE-2025-1679: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...
CVE-2025-10047
CVE-2025-10047 refers to a SQL Injection vulnerability in the WordPress plugin Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails . The issue exists in all versions up to and including 5.3.12 and stems from insufficient escaping of the user-sup...
CVE-2025-7850 Authenticated OS command execution
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways...
CVE-2025-10187
CVE-2025-10187 concerns the GSpeech TTS – WordPress Text To Speech Plugin. Wordfence reports an SQL injection via the field parameter in all versions up to 3.17.13, enabling authenticated users with Administrator-level access (and above) to inject additional SQL into existing queries to extract d...
WordPress Demo Import Kit plugin <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload vulnerability
Authenticated Admin+ Arbitrary File Upload vulnerability discovered by vodanh in WordPress Plugin Demo Import Kit versions = 1.1.0...
F5 Networks BIG-IP : BIG-IP tmsh vulnerability (K000154647)
The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6.1 / 17.1.3 / 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000154647 advisory. A vulnerability exists in the iHealth utility of the TMOS Shell tmsh that may allow an...