31705 matches found
Open Redirection
typo3/cms-core is vulnerable to Open Redirection. The vulnerability is due to improper sanitization of user-supplied URLs in the GeneralUtility::sanitizeLocalUrl function, which allows an attacker to manipulate sanitized URLs and redirect users to arbitrary external sites, enabling phishing attac...
MAL-2025-48417 Malicious code in cryptocom-corp-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1239238ee10c3bbee24c5972edf8784d63ed06bba75e7ff07eaf23dde788c82f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2018-21604
VestaCP commit a3f0fa1 2018-05-31 up to commit ee03eff 2018-06-13 contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot...
EUVD-2023-59994
BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The path parameter is not properly validated and is echoed into a shell context, allowing an attacker to inject and execute arbitrary shell commands on the device. Successfu...
WordPress External Login plugin <= 1.11.2 - Unauthenticated SQL Injection via log vulnerability
Unauthenticated SQL Injection via log vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin External Login versions = 1.11.2...
WordPress External Login plugin <= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection vulnerability
Authenticated Subscriber+ Sensitive Data Exposure via Test Connection vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin External Login versions = 1.11.2...
IBM Terracotta 安全漏洞
IBM Terracotta is a suite of distributed in-memory data management software from International Business Machines IBM. A security vulnerability exists in IBM Terracotta version 3.x that stems from unfiltered or unsalted handling of externally sourced keys, which could result in degraded cache writ...
The vulnerability of the arm64 component of the Linux operating system’s kernel, which allows a hacker to gain access to confidential data
The vulnerability of the arm64 component in the Linux operating system is related to improper protection of physical external channels. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...
WordPress plugin External Login SQL注入漏洞
The WordPress External Login plugin is mainly used to integrate WordPress login functionality with an external database system, allowing users to log in to the site directly through an external account. WordPress External Login plugin is prone to SQL injection vulnerability, which is caused by...
WordPress plugin External Login 信息泄露漏洞
The WordPress External Login plugin is mainly used to integrate WordPress login functionality with an external database system, allowing users to log in to the site directly through an external account. An information disclosure vulnerability exists in the WordPress External Login plugin, which...
The vulnerability of the system’s external link function for requests, incidents, and inventory management of computer equipment in GLPI allows a hacker to disclose protected information.
The vulnerability of the system’s external link functions for requests, incidents, and inventory management in GLPI is related to access control errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information...
QNAP Qsync Central SQL Injection Vulnerability
QNAP Qsync Central is a private cloud synchronization service launched by Weilian QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices, with functions similar to GoogleDrive, Dropbox and other cloud storage services, but with the data stored in the...
Simple Food Ordering System editproduct.php File SQL Injection Vulnerability
Simple Food Ordering System is a simple food ordering system. The Simple Food Ordering System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Category in the file /editproduct.php. An attacker can exploit...
CVE-2025-62361
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter metodo=listarTodos...
CVE-2025-58084
Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...
Directory Traversal
Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link r:link attribute instead...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link r:link attribute instead of embedded r:embed. The library resolves the URI to a file path and afte...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link r:link attribute instead of embedded r:embed. The library resolves the URI to a file path and afte...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link r:link attribute instead of embedded r:embed. The library resolves the URI to a file path and afte...