The vulnerability of the wsConvertPpt component in the Chamilo LMS e-learning and content management system allows a hacker to execute arbitrary commands.

The vulnerability of the wsConvertPpt component in the Chamilo LMS e-learning and content management system is related to the lack of measures taken to clean data at the administrative level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the PAN-OS operating system, related to the lack of measures for cleaning incoming data, allows attackers to compromise the integrity of protected information.

The vulnerability of the PAN-OS operating system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of the protected information...

PT-2025-30330 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat version 4.60 Description: A stored cross-site scripting XSS vulnerability exists in Live Helper Chat version 4.60. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Telegra...

PT-2025-30070 · Unknown · Agorum Core Open

Name of the Vulnerable Software and Affected Versions: agorum core open versions 11.9.2 and 11.10.1 Description: The software contains an XML External Entity XXE issue via the RSSReader endpoint. Attackers can potentially access sensitive data by providing a crafted XML input. Recommendations: Fo...

PT-2025-30100 · Unknown · Food Ordering Review System

Name of the Vulnerable Software and Affected Versions: code-projects Food Ordering Review System version 1.0 Description: A critical vulnerability exists in the Food Ordering Review System. The vulnerability affects unknown code within the /pages/signup function.php file. Manipulation of the fnam...

The vulnerability of the formBSSetSitesurvey() function (/goform/formBSSetSitesurvey) in the Wi-Fi range expansion software by Belkin F9K1122 allows a intruder to execute arbitrary commands.

The vulnerability of the formBSSetSitesurvey function /goform/formBSSetSitesurvey of the Belkin F9K1122 Wi-Fi range extender software is related to the lack of measures taken at the control level for data cleaning. Exploiting this vulnerability could allow a remote attacker to execute arbitrary...

Model Inversion Attacks on Llama 3: Extracting PII from Large Language Models

Large language models LLMs have transformed natural language processing, but their ability to memorize training data poses significant privacy risks. This paper investigates model inversion attacks on the Llama 3.2 model, a multilingual LLM developed by Meta. By querying the model with carefully...

The vulnerability of the Command Execution function in the file manager for managing files and directories in the File Browser allows a hacker to gain access to read and modify files.

The vulnerability of the Command Execution function in the file manager and File Browser web manager is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read and modify files...

Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

Project Paragraphs table provides a field for a collection table. The module doesn't sufficiently sanitise certain data attributes allowing Cross Site Scripting XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing...

The vulnerability of the `easy_uci_set_option_string_0()` function in the `/cgi-bin/lighttpd.cgi` file of the LB-LINK BL-AC3600 router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the easyucisetoptionstring0 function in the /cgi-bin/lighttpd.cgi file of the LB-LINK BL-AC3600 router microprogramming system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability could allow an attacker operating...

The vulnerability in the web interface of the operating system PAN-OS, which allows a perpetrator to execute arbitrary commands

The vulnerability in the web interface of the operating system PAN-OS is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

Cross-Site Scripting (XSS)

barryvdh/laravel-translation-manager is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to incorrect input validation and sanitization of user-input data, allowing attackers to inject arbitrary HTML or JavaScript code...

CVE-2025-48489

CVE-2025-48489 affects FreeScout (PHP/Laravel) prior to version 1.8.180. The issue is a Cross-Site Scripting (XSS) vulnerability caused by insufficient data validation and sanitization during data reception. Evidence across multiple sources confirms the vulnerability and notes that it has been pa...

Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073

The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently sanitise data attributes allowing persistent Cross Site Scripting XSS attacks. This vulnerability is...

CVE-2023-28637

DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerabili...

Remote Code Execution (RCE)

srfeuserregister is vulnerable to Remote Code Execution. The vulnerability is due to improper input validation and insufficient sanitization of user-supplied data, which allows attackers to inject and execute arbitrary PHP code on the server...

The vulnerability of the formSysCmd function in the microprogramming software of the D-Link DIR-600L router allows a hacker to execute arbitrary commands.

The vulnerability of the formSysCmd function in the microprogramming system of the D-Link DIR-600L router is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using the host parameter...

The vulnerability of the formSetSambaConf() function in the Tenda AC9 router software allows a hacker to execute arbitrary code.

The vulnerability of the formSetSambaConf function in the Tenda AC9 router software is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the wake_on_lan function in D-Link DIR-600L router software allows a hacker to execute arbitrary commands.

The vulnerability of the wakeonlan function in D-Link DIR-600L router software lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the host parameter...

CVE-2022-2146

The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting...