PYSEC-2025-118

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...

WordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Help Scout versions = 6.5.6...

WordPress JoomSport plugin <= 5.6.17 - Reflected Cross-Site Scripting via page vulnerability

Reflected Cross-Site Scripting via page vulnerability discovered by Colin Xu in WordPress Plugin JoomSport versions = 5.6.17...

WordPress plugin Animated Rotating Words 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

AZL-54692 CVE-2024-56738 affecting package grub2 2.06-16

GNU GRUB aka GRUB2 through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks...

WordPress plugin FAT Services Booking SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Trend Micro Cloud Edge 命令注入漏洞

Trend Micro Cloud Edge is a cloud security solution from Trend Micro designed to protect an organization's cloud infrastructure, applications and data. A security vulnerability exists in Trend Micro Cloud Edge versions 5.6SP2 and 7.0 that stems from the presence of a command injection vulnerabili...

PT-2024-39217 · WordPress · Getresponse Forms By Optin Cat

Name of the Vulnerable Software and Affected Versions: GetResponse Forms by Optin Cat plugin for WordPress versions up to, and including, 2.5.6 Description: The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site Scripting. This allows...

WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin ShortPixel Image Optimizer versions = 5.6.3...

PT-2024-38379 · WordPress · Forms For Mailchimp By Optin Cat

Name of the Vulnerable Software and Affected Versions: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the form color parameters due to insufficient input...

UBUNTU-CVE-2024-48949

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S.gtesig.eddsa.curve.n || sig.S.isNeg" validation...

PT-2024-32601 · Unknown · Webvitaly Page-List

Name of the Vulnerable Software and Affected Versions: Webvitaly Page-list versions n/a through 5.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. The vulnerability is du...

XZ Utils 安全漏洞

XZ Utils is an open source utility program by Tukaani. A security vulnerability exists in XZ Utils version 5.6.2 and earlier versions. An attacker can exploit this vulnerability to perform a parameter injection or directory traversal attack...

CVE-2024-43977

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.6.2...

Heating Network Wireless Monitoring System SQL注入漏洞

Star Measurement and Control Heating Network Wireless Monitoring System is a heating management system from Star Measurement and Control. A SQL injection vulnerability exists in Heating Network Wireless Monitoring System version 5.6.2, which stems from an operation of the GetDataKindByType functi...

CVE-2024-5583

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carouseldirection parameter of testimonials widget in all versions up to, and including, 5.6.2 due to insufficient input...

CVE-2024-6133

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

AZL-49596 CVE-2024-3056 affecting package podman for versions less than 5.6.1-2

A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources...

Elliptic 安全漏洞

Elliptic is a library of fast elliptic curve ciphers in javascript by the individual developer Fedor Indutny. A security vulnerability exists in Elliptic version 6.5.6, which stems from allowing the use of BER-encoded signatures, and therefore ECDSA signature malleability...

PT-2024-28211 · Unknown · Webappick Ctx Feed

Name of the Vulnerable Software and Affected Versions: WebAppick CTX Feed versions n/a through 6.5.6 Description: The issue is related to Improper Privilege Management in WebAppick CTX Feed, allowing Privilege Escalation. Recommendations: For versions n/a through 6.5.6, update to a version that...