CVE-2025-1514: Improper Input Validation

The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the getsmth function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attacke...

Malicious code in create-sensort-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da1473448f21d07682398de668daf47a21453a0c884d94a67902afec6616de29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2662 Malicious code in create-sensort-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da1473448f21d07682398de668daf47a21453a0c884d94a67902afec6616de29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

B&R Industrial Automation B&R APROL 代码注入漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A code injection vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-00P5, which stems from a code injection in the AprolCreateReport component that could allow a...

PT-2025-12461

Name of the Vulnerable Software and Affected Versions The Motors – Car Dealer, Classifieds & Listing plugin for WordPress versions up to, and including, 1.4.57 Description The issue is related to missing capability checks on the motors create template and motors delete template functions, allowin...

CVE-2025-30345

OpenSlides CVE-2025-30345 affects OpenSlides versions prior to 4.2.5. The vulnerability arises in the chat_group.create action: while some HTML elements (e.g., SCRIPT) are filtered, others are not, and HTML entities are not consistently encoded when deleting chats or deleting messages, potentiall...

The vulnerability of the rx_create() function in the drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the rxcreate function in the drivers/net/ethernet/mellanox/mlx5/core/enaccel/ipsecfs.c file of the Linux kernel is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

horticus.biz Cross Site Scripting vulnerability OBB-4038403

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Deserialization of Untrusted Data

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the AgentServerServicer.createagent method. An attacker can execute arbitrary commands on the server by deserializing untrust...

Cross-site Request Forgery (CSRF)

Overview polyaxon is a Command Line Interface CLI and client to interact with Polyaxon API. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the create endpoint. An attacker who can convince a user to follow a malicious link can cause the creation of a...

PYSEC-2025-17

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...

CVE-2025-0184

A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...

CVE-2025-1473

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

dify 代码问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A code issue vulnerability exists in version 0.10.2 of dify, which stems from the Create Knowledge section when uploading DOCX files is vulnerable to server-side request forgery attacks...

PT-2025-12233

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 0.0.6a3 Description A vulnerability in the RpcAgentServerLauncher class allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the...

CVE-2025-0184: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...

PT-2025-12301

Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.10.2 Description A Server-Side Request Forgery SSRF issue was identified in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested...

CVE-2025-29926

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard b...

kernel: net/mlx5e: fix a double-free in arfs_create_groups

A double-free vulnerability was found in the arfscreategroups function in the Linux kernel's net/mlx5e driver. This issue could lead to memory corruption or a system crash if exploited, as freeing the same memory twice may cause undefined behavior...

CVE-2025-2379

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /create-pass.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The...