Discourse 命令注入漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A command injection vulnerability exists in Discourse 3.5.0 and prior versions, which stems from a malicious meta-command that can be...

CVE-2025-9993

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

Arbitrary Code Injection

Craft CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to inadequate protection of restore functionality because, with a compromised security key and the ability to place an arbitrary file in storage/backups, an attacker can craft a request to /updater/restore-db that...

CVE-2025-9993

The CVE-2025-9993 entry concerns the Bei Fen – WordPress Backup Plugin for WordPress. It describes a Local File Inclusion (LFI) vulnerability exploitable via the task parameter in all versions up to 1.4.2, allowing authenticated users with Subscriber-level access or higher to include and execute ...

CVE-2025-9993 Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

PT-2025-40060

Name of the Vulnerable Software and Affected Versions The File Manager, Code Editor, and Backup by Managefy plugin for WordPress versions prior to 1.6.2 Description The plugin is susceptible to a sensitive information exposure issue due to publicly exposed log files. This allows unauthenticated...

PT-2025-39952

Name of the Vulnerable Software and Affected Versions Bei Fen – WordPress Backup Plugin versions through 1.4.2 Description The Bei Fen – WordPress Backup Plugin for WordPress is susceptible to Local File Inclusion through the task parameter. Attackers with Subscriber-level access or higher can...

CVE-2025-9993: Improper Control of Filename for Include/Require Statement in PHP Program

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

CVE-2025-57516

OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file...

PublicCMS 安全漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS PublicCMS-V5.202506.a version and PublicCMS-V5.202506.b version, which stems from incorrect manipulation of the DATABASE, USERNAME, or PASSWORD...

PT-2025-39832

Name of the Vulnerable Software and Affected Versions PublicCMS versions 5.202506.a through 5.202506.b Description An issue exists in PublicCMS that allows attackers to execute arbitrary commands. This occurs due to an OS command injection in the backupDB.bat file when processing crafted DATABASE...

CVE-2025-57516

OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file...

CVE-2025-10307

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with...

CVE-2025-10307: Improper Limitation of a Pathname to a Restricted Directory

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with...

Applying Custom Settings to Veeam Software Appliance

Purpose This article documents the configuration files on the Veeam Software Appliance that correspond to registry locations in Windows used for custom settings in Veeam Backup & Replication. Custom registry-based settings for Veeam Backup & Replication on Windows can also be applied to the Veeam...

CVE-2025-10360: Insufficiently Protected Credentials

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

Release Information for Veeam Plug-in for Proxmox VE v12.1.5.17

Requirements This update to the Veeam Plug-in for Proxmox VE requires: Veeam Backup & Replication build 12.3.2.3617 You can check the build number in the Veeam Backup & Replication Console's Main Menu ≡ under Help About. Veeam Plug-in for Proxmox VE build 12.1.3.217 You can check the current buil...

Build Numbers and Versions of Veeam Plug-In for Scale Computing HyperCore

This KB article lists all versions of the Veeam Plug-In for Scale Computing HyperCore and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-In for Scale Computing HyperCore 4 Releases Veeam Plug-In for Scale Computing HyperCore 4.1...

The vulnerability of the data management component of virtual machines in Hyper-V software for centralized backup and recovery management systems like PowerProtect Data Manager allows a malicious actor to gain unauthorized access to the file system.

The vulnerability of the data management component of virtual machines in Hyper-V software for centralized backup and recovery management systems like PowerProtect Data Manager is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability...

The vulnerability of the data management component of virtual machines in Hyper-V software for centralized backup and recovery management systems like PowerProtect Data Manager allows attackers to gain elevated privileges.

The vulnerability of the data management component in virtual machines within Hyper-V software for centralized backup and recovery management systems like PowerProtect Data Manager is related to the improper use of standard permissions. Exploiting this vulnerability can allow attackers to gain...