28865 matches found
CVE-2023-38952
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforc...
CVE-2025-41226
CVE-2025-41226 affects VMware ESXi (guest-operations DoS). A malicious actor with guest operation privileges, already authenticated via vCenter Server or ESXi, can trigger a DoS on guest VMs running VMware Tools. Connected IBM bulletin confirms this CVE and notes remediation via updates to VMware...
CVE-2025-41226 Guest Operations Denial-of-Service Vulnerability
VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a denial-of-service condition of guest VMs...
PT-2025-22147 · Vmware · Vmware Esxi +2
Name of the Vulnerable Software and Affected Versions: VMware ESXi affected versions not specified Description: The issue is a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated...
CVE-2025-2892
CVE-2025-2892 affects the WordPress plugin “All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic” (All in One SEO Pack). Tech details from connected sources show: vulnerable in versions up to and including 4.8.1.1 due to insufficient input sanitization and output escaping...
CVE-2025-4669 Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2025-3812
WPBot Pro Wordpress Chatbot (WordPress)
Exploit for CVE-2025-32583
🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE Exploit CRITI...
CVE-2025-1138 IBM Information Server information disclosure
IBM InfoSphere Information Server 11.7 could disclose sensitive information to an authenticated user that could aid in further attacks against the system through a directory listing...
Mattermost Fails to Validate Team Invite Permissions
Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team...
SUSE CVE-2024-45332
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2025-3053 UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uipprocessforminput function. This is due to the function taking user supplied inputs to execute arbitrary...
PT-2025-21274 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.6.x through 10.6.1 Mattermost versions 10.5.x through 10.5.2 Mattermost versions 10.4.x through 10.4.4 Mattermost versions 9.11.x through 9.11.11 Description: The issue arises from incorrect permission checks, allowing...
📄 Nextcloud Workflows Remote Code Execution
This Metasploit module adds workflows as an authenticated user which can only be created by administrators by design. If the app "Nextcloud Workflow Script" is installed it is possible to generate a workflow that executes commands. This module requires Metasploit: https://metasploit.com/download...
WordPress plugin Secure Downloads 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...
CVE-2025-30668
Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access...
CVE-2025-0134 Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM
A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM...
CVE-2025-3623 Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automatorapidecodemessage function. This makes it possible for unauthenticated to inject a PHP Object. The additional presen...
CVE-2025-4520 Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to...