CVE-2025-61141

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

CVE-2025-61141

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

CVE-2025-61141

The sqls-server/sqls project (specifically version 0.2.28 ) is vulnerable to command injection within the config command . The root cause is that the openEditor function fails to sanitize the EDITOR environment variable and the config file path before passing them to sh -c . This oversight allows...

CVE-2025-61141: Improper Neutralization of Special Elements used in a Command

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

CVE-2025-62802

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most...

EUVD-2025-36566

DNN CKEditor Provider allows unauthenticated upload out-of-the-box...

CVE-2025-62794

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...

CVE-2025-10922

GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

UBUNTU-CVE-2025-10920

GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open...

CVE-2025-10934 GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

CVE-2025-10925 GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2025-10923 GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2025-10922

CVE-2025-10922 affects GIMP, specifically the DCM file parsing component. It is a heap-based buffer overflow vulnerability that can lead to remote code execution and requires user interaction (visiting a malicious page or opening a malicious file). The issue arises from insufficient validation of...

CVE-2025-12347

A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editorfiles/save-file-ajax.php. Executing manipulation of the argument filepath/content can lead to unrestricted upload. The attack can be executed remotely. Th...

PT-2025-45665

Summary The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. Description An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads...

GIMP security vulnerabilities

GIMP is an open source bitmap image editor from the GIMP team. A security vulnerability exists in GIMP that stems from not properly validating the length of user-supplied data when parsing a DCM file, which could lead to a heap buffer overflow and remote code execution...

GIMP input validation error vulnerability

GIMP is an open source bitmap image editor from the GIMP team. An input validation error vulnerability exists in GIMP that stems from a lack of proper validation of user-supplied data when parsing a WBMP file, which could lead to an integer overflow that could execute arbitrary code in the curren...

GIMP security vulnerabilities

GIMP is an open source bitmap image editor from the GIMP team. A security vulnerability exists in GIMP that stems from a failure to properly validate the length of user-supplied data when parsing ILBM files, which could lead to remote code execution...

Arbitrary File Upload

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Arbitrary File Upload via the HTML editor provider. An attacker can overwrite existing files and potentially deface a website or...

CVE-2025-64095

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files...