CVE-2025-64521: Authentication Bypass by Alternate Name

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even...

EUVD-2008-1735

Malware in sbrugna...

EUVD-2016-3435

Malware in sbrugna...

EUVD-2024-47198

Malicious code in bioql PyPI...

EUVD-2022-34305

Malicious code in bioql PyPI...

pds_core: remove write-after-free of client_id

...

CVE-2025-6134

Projectworlds Life Insurance Management System 1.0 contains a SQL injection vulnerability in /insertClient.php, caused by manipulation of the client_id parameter. Remote exploitation is possible, and public disclosures exist. Other parameters may be affected. Connected sources note a remediation ...

CVE-2025-6134: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /insertClient.php. The manipulation of the argument clientid leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-6135: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /insertNominee.php. The manipulation of the argument clientid/nomineeid leads to sql injection. The attack can be initiated...

The vulnerability of the aysavegoogle_credentials() function in the Quiz Maker plugin of the WordPress content management system allows a hacker to gain unauthorized access to protected information and perform cross-site scripting attacks.

The vulnerability of the aysavegooglecredentials function in the Quiz Maker plugin of the WordPress content management system is related to deficiencies in the authentication process when processing the clientid parameter. Exploiting this vulnerability could allow an attacker, operating remotely,...

CVE-2025-37916

CVE-2025-37916 concerns the Linux kernel pds_core component. The issue is a use-after-free caused by a write-after-free of client_id in pdsc_auxbus_dev_del during stress testing, leading to a KFENCE reported bug chain. The fix removes the offending write-after-free by eliminating the client_id cl...

CVE-2025-37916 pds_core: remove write-after-free of client_id

In the Linux kernel, the following vulnerability has been resolved: pdscore: remove write-after-free of clientid A use-after-free error popped up in stress testing: Mon Apr 21 21:21:33 2025 BUG: KFENCE: use-after-free write in pdscauxbusdevdel+0xef/0x160 pdscore Mon Apr 21 21:21:33 2025...

CVE-2025-37916: Use After Free

In the Linux kernel, the following vulnerability has been resolved: pdscore: remove write-after-free of clientid A use-after-free error popped up in stress testing: Mon Apr 21 21:21:33 2025 BUG: KFENCE: use-after-free write in pdscauxbusdevdel+0xef/0x160 pdscore Mon Apr 21 21:21:33 2025...

CVE-2024-11302

A missing checkaccess function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized...

CVE-2025-2062

A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clientStatus.php. The manipulation of the argument clientid leads to sql injection. It is possible to launch the attack remotely. The exploit h...

CVE-2025-2062: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clientStatus.php. The manipulation of the argument clientid leads to sql injection. It is possible to launch the attack remotely. The exploit h...

CVE-2024-6040

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...

CVE-2024-6040

CVE-2024-6040 affects parisneo/lollms-webui v9.8 where lollms_binding_infos lacks the client_id parameter. The endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are vulnerable to CSRF and local attacks, ...

CVE-2024-6040 Missing client_id in parisneo/lollms-webui

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...

CVE-2024-6040 Missing client_id in parisneo/lollms-webui

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...