PT-2025-4301 · Aat · Aat

Name of the Vulnerable Software and Affected Versions: AAT Another Activity Tracker versions prior to 1.26 Description: AAT is a GPS-tracking application for tracking sportive activities, with an emphasis on cycling. The issue allows for data exfiltration from malicious apps installed on the same...

The vulnerability of the update_ex_detail.php script in the Portfolio Management System allows a perpetrator to gain unauthorized access to read, modify, and delete data, as well as execute arbitrary code.

The vulnerability of the updateexdetail.php script in the Portfolio Management System is related to the failure to eliminate special elements during the processing of the q parameter. Exploiting this vulnerability allows an attacker who operates remotely to gain unauthorized access to read, modif...

The vulnerability of the _all_edits.php (/_parse/_all_edits.php) script in the Job Recruitment system allows a perpetrator to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the alledits.php /parse/alledits.php script in the Job Recruitment system relates to the failure to neutralize special elements during the processing of the skillset parameter. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized acces...

The vulnerability of the HFS File System Handler component in the Grub (Grub2) operating system allows a perpetrator to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the HFS File System Handler component in the Grub Grub2 operating system is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to influence the confidentiality, integrity, and accessibility of protected information...

Apple macOS Access Control Vulnerability

macOS is a set of operating systems developed by Apple to run on the Macintosh family of computers. Apple macOS suffers from an access control vulnerability that stems from the fact that applications may be able to access sensitive user data. An attacker could exploit the vulnerability to obtain...

PT-2025-34398 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue where DA monitors tracepoints, when used with KASAN enabled, can trigger a global-out-of-bounds read due to reading 32 bytes as an array instead of a...

PHPGurukul Small CRM 注入漏洞

Small CRM is a customer relationship management system. Small CRM suffers from a SQL injection vulnerability, which originates from an SQL injection vulnerability in the id parameter of the /admin/edit-user.php file. An attacker can exploit this vulnerability to obtain sensitive information or...

CVE-2024-39025

Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data...

CVE-2024-39025: Incorrect Authorization

Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data...

CVE-2024-12428 WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection

The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'orderuserlogindir' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-12428

CVE-2024-12428 concerns the WP Data Access – App, Table, Form and Chart Builder WordPress plugin. The vulnerability is an unauthenticated SQL Injection via the parameter order[user_login][dir], exploitable in all versions up to and including 5.5.22, caused by insufficient escaping of the user-sup...

CVE-2024-12190

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and...

CVE-2024-12032

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiryid' parameter of the 'tfenquiryreplyemailcallback' function in all versions up to, and including, 2.15.3 due to...

PT-2024-10267 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0 Description: The issue is related to a vulnerability in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools, which can be exploited by a low-privileged attacker with network...

Vulnerability of the fs/9p components of the Linux operating system’s kernel, allowing attackers to read and manipulate data

The vulnerability of the fs/9p components of the Linux operating system’s kernel is related to improperly set permissions in the p9mode2perm function. Exploiting this vulnerability allows an attacker to read and manipulate data...

WordPress plugin WP Data Access SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

CVE-2024-12428: Improper Neutralization of Special Elements used in an SQL Command

The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'orderuserlogindir' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2025-4231 · Oracle · Oracle Advanced Outbound Telephony +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.10 Description: The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from...

WordPress WP Data Access plugin <= 5.5.22 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin WP Data Access versions = 5.5.22...

CVE-2024-12266 ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elexdpexportrules and elexdpimportrules functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated...