Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass

Exploit Title: Fortinet FortiOS, FortiProxy, and FortiSwitchManager 7.2.0 - Authentication bypass Date: 2022-10-10 Exploit Author: Zach Hanley, SC Vendor Homepage: https://www.fortinet.com Version: 7.0.0 Tested on: Linux CVE : CVE-2022-40684 This module requires Metasploit:...

IBM Sterling Control Center 安全漏洞

IBM Sterling Control Center is an application system from International Business Machines IBM, Inc. A centralized monitoring and management system. A security vulnerability exists in IBM Sterling Control Center versions 6.2.1, 6.3.1, and 6.4.0 that originates from a web page that can be stored...

DEBIAN-CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2022-4017

creationtimestamp| type| source ---|---|--- 2025-04-02 15:33:23+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10095...

CVE-2025-28094

shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places...

CVE-2025-28092

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery SSRF via image upload function...

GHSA-HH3M-G4QJ-4835 Spring Security Vulnerable to Authorization Bypass via Security Annotations

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2023-47539

An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remotewildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request...

CVE-2023-37933

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests...

CVE-2025-27394

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new SNMP users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...

Malicious code in patternfly-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 057836fcde782f283efd1e52688d31d8375cd7d963b136908d1457ea24e64193 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

novel 代码注入漏洞

novel is an open source novel system by xxyopen open source. A security vulnerability exists in novel 4.4.0 and earlier versions, which stems from vulnerability to remote code execution attacks...

CVE-2022-4095

creationtimestamp| type| source ---|---|--- 2025-02-26 16:24:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5525...

WordPress plugin Booknetic 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

UBUNTU-CVE-2025-27144

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

WordPress plugin Photo Gallery ( Responsive ) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-7723 · Unknown · Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery Responsive versions prior to 4.0 Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This issue enables an attacker to perform actions on behalf of another user without their knowledge or consent...

PT-2025-7700

Name of the Vulnerable Software and Affected Versions vTiger CRM version 6.4.0 Description A problematic issue has been identified, affecting the /modules/Mobile/index.php file. The manipulation of the operation argument leads to cross-site scripting. This issue can be exploited remotely...

CVE-2023-51301

A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...

Wazuh Unsafe Deserialization / Remote Code Execution

Wazuh versions starting at 4.4.0 and before 4.9.1 suffer from an unsafe deserialization vulnerability that allows for remote code execution...