WordPress Generate Post Thumbnails plugin <= 0.8 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Generate Post Thumbnails versions = 0.8...

Deserialization of Untrusted Data

Overview yiisoft/yii2 is a Yii PHP Framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Generate function. Details Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be...

WordPress plugin Generate Post Thumbnails 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...

Denial of Service (DoS)

Overview imaginAIry is an AI imagined images. Pythonic generation of images. Affected versions of this package are vulnerable to Denial of Service DoS over the /api/stablestudio/generate endpoint. An attacker can cause the server to crash and return KILLED to all clients by sending a payload with...

Exploit for CVE-2025-26056

CVE-2025-26056 Auhtor: Rohan Deshpande OS Command Inject...

Cross-site Request Forgery (CSRF)

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the generateaccesstoken function in auth.py. Remediation Upgrade zenml to version 0.73.0 or higher. References - GitHub Commit...

SUSE CVE-2022-49174

In the Linux kernel, the following vulnerability has been resolved: ext4: fix ext4mbmarkbb with flexbg with fastcommit In case of flexbg feature which is by default enabled, extents for any given inode might span across blocks from two different block group. ext4mbmarkbb only reads the bufferhead...

CVE-2024-13538

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.19. This is due the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering an error. This makes it possible...

CVE-2024-3572

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...

CVE-2024-49646

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ioannup Code Generate code-generator allows Reflected XSS.This issue affects Code Generate: from n/a through = 1.0...

CVE-2024-37555

Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through = 4.1.2...

Cross-site Scripting (XSS)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Cross-site Scripting XSS through the generateRow method. An attacker can execute arbitrary JavaScript code in the user's browser...

The vulnerability of the imagination AI image and video generation generator, related to server blocking, allows a violator to trigger a service failure.

The vulnerability of the imagination AI image and video generation service is related to a server crash due to uncontrolled resource consumption during the processing of the api/stablestudio/generate endpoint. Exploiting this vulnerability could allow an attacker to cause a service outage by...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the generateNavigation function, which translates the XLSX file into an HTML representation and displays it in the response without proper sanitization for the sheet's title. Remediation There is no fixed...

Cross-site Scripting (XSS)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Cross-site Scripting XSS in the generateNavigation function, which translates the XLSX file into an HTML representation and...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the generateoverlibcontent function, which is accessible through the descr parameter at t...

Software Bill of Materials (SBOM) for your Spin Apps

Learn how to generate, scan, and distribute Software Bill of Materials SBOM for Spin applications using trivy and oras...

CVE-2023-46637 WordPress Generate Dummy Posts plugin <= 1.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saurav Sharma Generate Dummy Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Generate Dummy Posts: from n/a through 1.0.0...

PT-2025-1526 · Unknown · Generate Dummy Posts

Name of the Vulnerable Software and Affected Versions: Generate Dummy Posts versions 1.0.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to unauthorized access du...

Server-side Request Forgery (SSRF)

Overview fastchat is a fastchat with guidance support Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the workergeneratestream API endpoint. An attacker can exploit the victim controller API server's credentials to perform unauthorized web actions or...