RSJoomla! RSform!Pro 代码注入漏洞

RSJoomla! RSform!Pro is a form component from RSJoomla! A code injection vulnerability exists in RSJoomla! RSform!Pro versions 3.0.0 through 3.3.14, which stems from a flaw in the submit export functionality that could lead to remote code execution...

FIN6 Uses AWS-Hosted Fake Resumes on LinkedIn to Deliver More_eggs Malware

The financially motivated threat actor known as FIN6 has been observed leveraging fake resumes hosted on Amazon Web Services AWS infrastructure to deliver a malware family called Moreeggs. "By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group...

PHPGurukul Restaurant Table Booking System 代码注入漏洞

PHPGurukul Restaurant Table Booking System is a restaurant table booking system from PHPGurukul. A code injection vulnerability exists in version 1.0 of the PHPGurukul Restaurant Table Booking System, which originates from a cross-site scripting attack due to the incorrect operation of the...

SourceCodester Online Student Clearance System 代码注入漏洞

SourceCodester Online Student Clearance System is a SourceCodester open source online student management system. A code injection vulnerability exists in SourceCodester Online Student Clearance System version 1.0, which originates from a cross-site scripting attack due to the incorrect operation ...

Dell Wyse Management Suite WMS 跨站脚本漏洞

Wyse Management Suite WMS is a combined cloud and local management platform from Dell. A cross-site scripting vulnerability exists in Wyse Management Suite WMS that stems from improper input neutralization and can be exploited by an attacker to cause code injection...

CVE-2025-48140

Improper Control of Generation of Code 'Code Injection' vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through = 1.1.4...

CVE-2025-48123

Improper Control of Generation of Code 'Code Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for...

CVE-2025-48123

CVE-2025-48123 is a confirmed Remote Code Execution (RCE) vulnerability in the WordPress plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light (Holest Engineering)

CVE-2025-48123 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for...

CVE-2025-48123 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Remote Code Execution (RCE) Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows Code Injection. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37...

CVE-2025-48140 WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through = 1.1.4...

CVE-2025-48140

CVE-2025-48140 is a confirmed RCE in the WordPress plugin MetalpriceAPI (versions ≤ 1.1.4) due to an improper control of code generation. The vulnerability allows code execution on affected sites; patch status indicates a fix has been applied in later versions. Affected product is the MetalpriceA...

CVE-2025-48140 WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through = 1.1.4...

CVE-2025-49013

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

CVE-2025-49013

CVE-2025-49013 describes a code-injection vulnerability in WilderForge GitHub Actions workflows caused by unsafe use of user-controlled variables (notably ${{ github.event.review.body }}) inside shell script contexts. The issue affects WilderForge/WilderForge, WilderForge/ExampleMod, WilderForge/...

CVE-2025-49013 WilderForge vulnerable to code Injection via GitHub Actions Workflows

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

CVE-2025-49013 WilderForge vulnerable to code Injection via GitHub Actions Workflows

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

CVE-2025-49013 WilderForge vulnerable to code Injection via GitHub Actions Workflows

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

Arbitrary Code Injection

org.hibernate.validator:hibernate-validator is vulnerable to Arbitrary Code Injection. The vulnerability is due to expression language injection due to interpolation of user-supplied input in constraint violation messages using Expression Language, which may allow attackers to access sensitive da...

PT-2025-24436 · Unknown +1 · Wilderforge +1

Name of the Vulnerable Software and Affected Versions: WilderForge affected versions not specified Description: A critical issue has been identified in the WilderForge organization, stemming from the unsafe use of user-controlled variables, such as $ github.event.review.body , directly inside she...