CVE-2024-48892

A relative path traversal vulnerability CWE-23 in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacker to read arbitrary files via uploading a malicious solution pack...

CVE-2024-48892

FortiSOAR (Fortinet) is affected by a relative path traversal (CWE-23) that can allow an authenticated attacker to read arbitrary files by uploading a malicious solution pack. Affected versions include 7.3 all versions, 7.4 all versions, 7.5.0–7.5.1, and 7.6.0. The underlying issue is exposed via...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in the process. An attacker can cause a system crash or resource exhaustion by providing specially crafted input during local authenticated access. Remediation A fix was pushed into the...

CVE-2025-26472

CVE-2025-26472 affects Intel® Tiber™ Edge Platform Edge Orchestrator software prior to version 24.11.1. The issue is an uncontrolled resource consumption that may allow an authenticated user to cause a denial of service via adjacent access. Intel’s security advisory and related Red Hat/CNVD/NVD e...

CVE-2025-26472

Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for IntelR TiberTM Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access...

CVE-2025-24520

CVE-2025-24520 affects Intel® Local Manageability Service prior to 2514.7.16.0. Inserting sensitive information into a log file may allow an authenticated local attacker to disclose data. Remediation: update LMS to 2514.7.16.0 or later. No exploitation details are provided in the documents; CVSS ...

CVE-2025-21090

Missing reference to active allocated resource for some IntelR XeonR processors may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-41982

A vulnerability has been identified in SmartClient modules Opcenter QL Home SC All versions = V13.2 = V13.2 = V13.2 V2506. The affected application does not have adequate encryption of sensitive information. This could allow an authenticated attacker to gain access of sensitive information...

CVE-2024-41982

A vulnerability has been identified in SmartClient modules Opcenter QL Home SC All versions = V13.2 = V13.2 = V13.2 V2506. The affected application does not have adequate encryption of sensitive information. This could allow an authenticated attacker to gain access of sensitive information...

CVE-2024-41982

CVE-2024-41982 affects SmartClient Opcenter QL Home, SOA Audit, and SOA Cockpit with SmartClient versions 13.2 through 2505; root cause is lack of adequate encryption of sensitive information. Patched versions >= 2506 are available as remediation. (Connected PT-2025-32640 confirms the version ...

CVE-2024-41982

A vulnerability has been identified in SmartClient modules Opcenter QL Home SC All versions = V13.2 = V13.2 = V13.2 V2506. The affected application does not have adequate encryption of sensitive information. This could allow an authenticated attacker to gain access of sensitive information...

CVE-2024-41980

The CVE-2024-41980 issue affects SmartClient Opcenter QL Home, SOA Audit, and SOA Cockpit. Affected SmartClient components do not encrypt LDAP interface communications by default, enabling an authenticated attacker to access sensitive information. Affected versions are 13.2 through 2505 (inclusiv...

CVE-2024-41979

A vulnerability has been identified in SmartClient modules Opcenter QL Home SC All versions = V13.2 = V13.2 = V13.2 V2506. The affected application does not enforce mandatory authorization on some functionality level at server side. This could allow an authenticated attacker to gain complete acce...

CVE-2025-8418 B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation

The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activatedplugin function. This makes it possible for authenticated attackers, with...

CVE-2025-8418

CVE-2025-8418 : B Slider – Gutenberg Slider Block for WP (WordPress) is vulnerable up to version 1.1.30 due to missing capability checks on the activated_plugin function. Authenticated users with subscriber-level access or higher can install arbitrary plugins, potentially enabling remote code exe...

CVE-2025-8621 Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter

The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8621 Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter

The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8688 Inline Stock Quotes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode

The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8690 Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...

CVE-2025-5391 WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...