14018 matches found
CVE-2025-49196
CVE-2025-49196 is associated in connected sources with SICK Field Analytics and SICK Media Server, where the vulnerability stems from supporting a deprecated and unsafe TLS version. Impacts are described as affecting confidentiality and integrity; exploitation details are not provided, and public...
PT-2025-25351 · Aveva · Aveva Pi Connector For Cygnet
Name of the Vulnerable Software and Affected Versions: AVEVA PI Connector for CygNet versions 1.6.14 and prior Description: An improper validation of integrity check value issue exists that, if exploited, could allow a miscreant with elevated privileges to modify local data files in a way that...
PYSEC-2025-74
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...
PYSEC-2025-74
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...
PYSEC-2025-79
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...
CVE-2025-49142
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...
CVE-2025-3117
CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...
CVE-2025-49142: Improper Neutralization of Special Elements Used in a Template Engine
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...
Schneider Electric Modicon Controllers Cross-site Scripting Vulnerabilities
Schneider Electric Modicon Controllers are a series of Modicon series programmable logic controllers from Schneider Electric, France. A cross-site scripting vulnerability exists in Schneider Electric Modicon Controllers that originates from improper input neutralization during web page generation...
Oracle VM VirtualBox Core Component Data Access
The vulnerability of the Core component of the Oracle VM VirtualBox software lies in an improper access to common directories due to incorrectly implemented authentication procedures. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data, or cause...
TOTOLINK T10 Security Vulnerabilities
The TOTOLINK T10 is a dual-band mesh networking router from TOTOLINK for full coverage needs of home and office networks. A buffer overflow vulnerability exists in TOTOLINK T10. The vulnerability stems from incorrect manipulation of the parameter desc in the file /cgi-bin/cstecgi.cgi. An attacker...
CVE-2025-5018
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...
CVE-2025-5814
The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...
CVE-2025-5814 Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration
The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...
CVE-2025-5814 Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration
The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...
WordPress plugin Profiler has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
SQL Injection
llamaindex is vulnerable to SQL Injection. The vulnerability is due to SQL injection due to improper handling of user input in multiple vector store integrations, allowing attackers to manipulate SQL queries and access or modify unauthorized data...
CVE-2025-5018
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...
CVE-2025-5018
CVE-2025-5018 affects the WordPress Hive Support plugin (<= 1.2.4; Patch references include
CVE-2025-1777
CVE-2025-1777 : BM Content Builder (WordPress) has a missing authorization check in ux_cb_page_options_save, allowing authenticated users with subscriber+ access to perform a stored cross-site scripting attack. Affected versions: ≤ 3.16.2.1. Impact per sources: unauthorized data modification and ...