16407 matches found
CVE-2025-13284
ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...
CVE-2025-63227
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An attacker with administrative credentials can upload arbitrary files e.g., PHP webshells, which are stored in the /patch/ directory. This...
AWS Resources MCP Server 安全漏洞
AWS Resources MCP Server is a Python-based MCP server by Bary Huang Personal Developer. A security vulnerability exists in AWS Resources MCP Server version 0.1.0, which stems from insufficient input validation of the executequery method and could lead to remote code execution and AWS credential...
PT-2025-47335
Name of the Vulnerable Software and Affected Versions Kotaemon version 0.11.0 Description A cross site scripting XSS issue exists in Kotaemon version 0.11.0. This allows attackers to execute arbitrary code through a specially crafted PDF file. The issue involves the potential for malicious code...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
CVE-2024-42749
Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script...
EUVD-2025-197651
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
CVE-2025-10686
The Creta Testimonial Showcase WordPress plugin versions prior to 1.2.4 is vulnerable to Local File Inclusion (LFI) . This flaw allows authenticated attackers with editor-level access or higher to include and execute arbitrary files on the server, which can lead to the execution of arbitrary PHP ...
ZOHO ManageEngine Applications Manager Command Injection Vulnerability
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A command injection...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...
EUVD-2025-178372
Malicious code in interface-stack-mock-execute-log npm...
EUVD-2025-179091
Malicious code in epsilon-execute-pi-interpret-index npm...
EUVD-2025-175634
Malicious code in water-execute-rain-root-cloud npm...
EUVD-2025-176426
Malicious code in serialize-bash-authenticate-execute-cloud npm...
EUVD-2025-179761
Malicious code in char-cat-execute-eta-authenticate npm...
EUVD-2025-175553
Malicious code in wind-execute-authorize-mu-byte npm...
EUVD-2025-175815
Malicious code in unix-zeta-star-execute-uglify npm...