CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks

A high-severity security flaw impacting the Craft content management system CMS has been added by the U.S. Cybersecurity and Infrastructure Security Agency CISA to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability in question is...

PT-2025-7404 · WordPress · Head

Name of the Vulnerable Software and Affected Versions: Head, Footer and Post Injections plugin for WordPress versions up to, and including, 3.3.0 Description: The issue allows authenticated attackers with Administrator-level access and above to inject PHP code in multisite environments...

D-Link DIR-816 Code Injection Vulnerability

The D-Link DIR-816 is a wireless router from China's AUO D-Link. A code injection vulnerability exists in the D-Link DIR-816 version 1.01TO, which stems from the fact that incorrect operation of the parameter SSID can lead to cross-site scripting attacks. The vulnerability can be exploited by an...

WordPress plugin Head, Footer and Post Injections 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in th...

WordPress Head, Footer and Post Injections plugin <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments vulnerability

Authenticated Administrator+ PHP Code Injection in Multisite Environments vulnerability discovered by Francesco Carlucci in WordPress Plugin Head, Footer and Post Injections versions = 3.3.0...

CVE-2025-0161 IBM Security Verify Access Appliance code injection

IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation...

CVE-2025-0161 IBM Security Verify Access Appliance code injection

IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-23209link is external Craft CMS Code Injection Vulnerability CVE-2025-0111link is external Palo Alto Networks PAN-OS File Read Vulnerability These types of...

Malicious code in mstplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 48409bd7f3f22c084f0f0269402f93d8327e3d8d89edf03641e8093e0b22938c This package is a typosquat of the matplotlib package and executes harmful code during installation. It appears to inject code into Python files...

IBM Security Verify Access 代码注入漏洞

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. A code injection vulnerability exists in IBM Security Verify Access versions 10.0.0.0 through 10.0.0.9 and 11.0.0.0, which stems from improper restrictions on code generation...

PT-2025-7291 · Phpjabbers · Phpjabbers Car Park Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Car Park Booking System version 3.0 Description: The issue concerns multiple HTML injection vulnerabilities in the name, plugin sms api key, plugin sms country code, and title parameters. This allows for potential malicious code...

WordPress plugin WooCommerce Food - Restaurant Menu & Food ordering 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in the...

Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution...

CVE-2025-1465

A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high...

CVE-2025-1465

A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high...

CVE-2025-1465

CVE-2025-1465 affects lmxcms 1.41, specifically the db.inc.php file in the Maintenance component. The Red Hat/NVD entries describe an unknown function being manipulated to achieve code injection, with remote exploitation possible. Exploitability is characterized as difficult and needs high privil...

CVE-2025-1465 lmxcms Maintenance db.inc.php code injection

A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high...

CVE-2025-1465 lmxcms Maintenance db.inc.php code injection

A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high...

lmxcms 注入漏洞

lmxcms dream cms is a website builder from China Dream Cms lmxcms company. An injection vulnerability exists in lmxcms version 1.41, which originates from the file db.inc.php of the component Maintenance that can lead to code injection...

CVE-2025-0423 Multiple Unauthenticated Stored Cross-Site Scripting

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...