8572 matches found
CVE-2025-3247
The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7stripeskipspamcheck' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe...
Authorization Bypass Through User-Controlled Key
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the revoke action process. An attacker can access sensitive user information and disrupt user access by exploiting improper access control...
Authorization Bypass Through User-Controlled Key
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient capability checks in the RSS block. An attacker can access and view additional RSS feeds by exploiting the IDOR vulnerability...
CVE-2025-3640: Authorization Bypass Through User-Controlled Key
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access...
PT-2025-54610
Уязвимость почтового клиента Microsoft Outlook связана с включением функций из недостоверной контролируемой области. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...
Developing a Blockchain-Based Secure Digital Contents Distribution System
As digital content distribution expands rapidly through online platforms, securing digital media and protecting intellectual property has become increasingly complex. Traditional centralized systems, while widely adopted, suffer from vulnerabilities such as single points of failure and limited...
MAL-2025-3542 Malicious code in concurrent-hashmap (npm)
This package runs a post-install script that exfils sensitive data to a attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b043630941c12131f7d10fdb97608a15c397c2cf21e74116aa2fd89a1840a58e Any computer that has this package installed or runni...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
Video Tutorial !CVE-2025-24071 Demohttps://img.youtube.co...
MAL-2025-3543 Malicious code in slf4j-api-js (npm)
This package runs a post-install script that exfils sensitive data to a attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3bf0cf1724507eaf1d28ec976793772cc682047cc52a74438224fb96d61884b Any computer that has this package installed or runni...
Sonos api.sonos.com 安全漏洞
Sonos api.sonos.com is an interface service from Sonos, Inc. A security vulnerability exists in Sonos api.sonos.com version 2025-04-21 and earlier, which originates in the /login/v3/oauth endpoint that accepts a redirecturi containing user information, which could result in an authorization code...
SUSE CVE-2017-9333
OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger...
Q-FAKER: Query-Free Hard Black-Box Attack Via Controlled Generation
Many adversarial attack approaches are proposed to verify the vulnerability of language models. However, they require numerous queries and the information on the target model. Even black-box attack methods also require the target model's output information. They are not applicable in real-world...
Clickjacking
tarteaucitronjs is vulnerable to clickjacking. The vulnerability is due to improper validation of user-controlled CSS inputs for element dimensions, allowing attackers to overlay the viewport with malicious elements...
CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-30257 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...
CVE-2025-30257
CVE-2025-30257 relates to Growatt Cloud portal authorization bypass through a user-controlled key. The included connected records confirm that unauthenticated attackers can retrieve the serial number of smart meters associated with a specific user account, indicating an information disclosure vul...
CVE-2025-31360
CVE-2025-31360 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources confirm an unauthenticated attacker can trigger device actions associated with specific “scenes” of arbitrary users, implying remote control of devices without user interaction. The vulnerability ...