CVE-2025-54393

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obtain administrative access...

CVE-2025-54393

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obtain administrative access...

PT-2025-32282 · Netwrix +1 · Netwrix Directory Manager +1

Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager formerly Imanami GroupID versions 11.0.0.0 through 11.1.25162.02 Description: The software contains a SQL injection issue. Authenticated users can exploit this issue. Recommendations: Update Netwrix Directory Manager...

CVE-2025-54396

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit this...

PT-2025-32283 · Imanami +1 · Groupid +1

Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager versions 11.0.0.0 through 11.1.25161.02 Description: Netwrix Directory Manager formerly Imanami GroupID inserts sensitive information into data sent to authenticated users. Recommendations: Update to version...

CVE-2025-54397

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users...

Netwrix Directory Manager 安全漏洞

Netwrix Directory Manager is a group and user management software from Netwrix, Inc. A security vulnerability exists in Netwrix Directory Manager versions prior to 11.1.25162.02, which originates from sensitive information contained in data sent to authenticated users...

CVE-2025-54396

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit this...

CVE-2025-54396

The CVE-2025-54396 entry affects Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25162.02. The vulnerability is SQL injection that can be exploited by authenticated users. Root cause and impact are described as SQL injection with low to moderate impact (per CVS...

CVE-2025-7727 Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks

The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-7399 Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

SUSE CVE-2025-47871

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive informatio...

CVE-2025-6690 WP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter

The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-54962

/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files such as .html or .svg, and these are then publicly accessible under the /static URI...

PT-2025-32174 · Unknown · Mobile Access Portal File Share

Name of the Vulnerable Software and Affected Versions: Mobile Access Portal File Share application affected versions not specified Description: The Mobile Access Portal's File Share application is susceptible to a directory traversal attack. An authenticated, malicious end-user with authorization...

CVE-2025-50233

A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend template editor. By manipulating the parameter, attackers can perform directory traversal and access sensitive files outsi...

CVE-2012-10024

XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw ...

CVE-2025-5061

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-6207

The WP Import Export Lite plugin for WordPress is affected by an arbitrary file upload vulnerability caused by missing file type validation in the wpie_tempalte_import function, affecting all versions up to and including 3.9.28. Authenticated users with Subscriber-level access or higher, and with...

OpenPLC Runtime version 3 代码问题漏洞

OpenPLC Runtime version 3 is a programmable logic controller by the individual developer Thiago Alves. A code issue vulnerability exists in OpenPLC Runtime version 3 that originates from allowing an authenticated user to upload arbitrary files and access them publicly...