IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2025-04972)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure...

CVE-2024-13834 Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request

The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remoterequest' function. This makes it possible for authenticated attacker...

CVE-2025-1270

Insecure direct object reference IDOR vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/hadatoshermano.php” endpoint to refer to another user. In addition, the...

CVE-2025-0822

CVE-2025-0822 : The Bit Assist WordPress plugin is vulnerable to a path traversal issue via the fileID parameter, allowing authenticated users with Subscriber+ privileges to read arbitrary server files. Affected: Bit Assist plugin versions up to and including 1.5.2. Impact: potential exposure of ...

CVE-2024-13500

CVE-2024-13500 affects the WordPress plugin “WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts”. It describes a time-based SQL Injection via the wager parameter orderby in all versions up to 2.6.17, caused by insufficient escaping and inadequat...

CVE-2025-1005

CVE-2025-1005 affects ElementsKit Elementor Addons and Templates (WordPress) up to version 3.4.0. It is a Stored Cross-Site Scripting via the Image Accordion widget caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authenticated acces...

CVE-2024-13639

The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2025-22208 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands via the 'filteremail' parameter in the GDPR Erase Data Request search feature...

CVE-2025-22209 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature...

CVE-2025-22209

The JS Jobs plugin for Joomla (versions 1.1.5-1.4.3 ) contains a SQL injection vulnerability. This flaw allows authenticated attackers with administrator privileges to execute arbitrary SQL commands via the searchpaymentstatus parameter within the Employer Payment History search feature. To mitig...

CVE-2024-5461

Implementation of the Simple Network Management Protocol SNMP operating on the Brocade 6547 FC5022 embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only...

CVE-2024-5461

Implementation of the Simple Network Management Protocol SNMP operating on the Brocade 6547 FC5022 embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only...

CVE-2024-5461 Command or parameter injection via unique embedded switch SNMP commands.

Implementation of the Simple Network Management Protocol SNMP operating on the Brocade 6547 FC5022 embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only...

CVE-2024-5461 Command or parameter injection via unique embedded switch SNMP commands.

Implementation of the Simple Network Management Protocol SNMP operating on the Brocade 6547 FC5022 embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only...

CVE-2024-5461

CVE-2024-5461 affects Brocade Fabric OS on the Brocade 6547 (FC5022) embedded switch blade. The SNMP implementation makes internal script calls to system.sh, allowing an authenticated attacker to injection commands/parameters and potentially execute as root. Affected behavior is the SNMP operatio...

Joomsky JS Jobs 安全漏洞

Joomsky JS Jobs is a Joomla Content Management System CMS based recruitment management plugin from Joomsky. A security vulnerability exists in Joomsky JS Jobs versions 1.1.5 through 1.4.3, which stems from an SQL injection vulnerability that allows an authenticated attacker to execute arbitrary S...

Joomsky JS Jobs 安全漏洞

Joomsky JS Jobs is a Joomla Content Management System CMS based recruitment management plugin from Joomsky. A security vulnerability exists in Joomsky JS Jobs versions 1.1.5 through 1.4.3, which stems from an SQL injection vulnerability that allows an authenticated attacker to execute arbitrary S...

CVE-2025-26350

A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...

CVE-2025-26348

A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'" in maxprofile/menu/model.lua editUserMenu endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP reques...

CVE-2025-26356

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua setActive endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...