CVE-2025-1732

An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable...

CVE-2025-3577

CVE-2025-3577 affects Zyxel AMG1302-T10B (firmware 2.00(AAJC.16)C0). The issue is a path traversal in the web management interface that an authenticated administrator can exploit by sending a crafted HTTP request to access restricted directories. The CVSS metrics indicate Network access with Low ...

CVE-2025-3577

UNSUPPORTED WHEN ASSIGNED A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00AAJC.16C0 could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTTP request to an affected...

CVE-2025-2987

IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

PT-2025-17551 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. It is...

CVE-2025-2987 IBM Maximo Asset Management server-side request forgery

IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2025-25228

A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands in the product management area in backend...

OpenText Content Management 安全漏洞

OpenText Content Management is an enterprise content management software from OpenText Canada. A security vulnerability exists in OpenText Content Management versions 24.3 through 25.1, which stems from a user enumeration and data integrity issue in the barcode functionality, which could lead to ...

CVE-2025-1457 Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization...

CVE-2025-36625

In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application...

CVE-2025-36625 Log Poisoning in Nessus

In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application...

CVE-2024-13650

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-31949

An authenticated attacker can obtain any plant name by knowing the plant ID...

CVE-2025-30511

An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...

CVE-2025-3295

The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive...

CVE-2022-43840

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document...

CVE-2025-32843

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'LockUser' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write ...

CVE-2025-32830

The CVE-2025-32830 issue affects TeleControl Server Basic (versions

CVE-2025-20178 Cisco Secure Network Analytics Privilege Escalation Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient integrity...