WordPress plugin MediaView 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

CVE-2025-2481: Improper Neutralization of Input During Web Page Generation

The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2025-13393 · Unknown · Hay-Kot Mealie

Name of the Vulnerable Software and Affected Versions: hay-kot mealie version 2.2.0 Description: A Broken Object Level Authorization vulnerability in the component "/api/users/user-id" of hay-kot mealie allows users to edit their own profile in order to give themselves more permissions or to chan...

PT-2025-13001

Name of the Vulnerable Software and Affected Versions MediaView plugin for WordPress versions up to, and including, 1.1.2 Description The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping in the id parameter. This allows unauthenticated...

PT-2025-12469

Name of the Vulnerable Software and Affected Versions WooCommerce Multivendor Marketplace – REST API plugin for WordPress versions up to, and including, 1.6.2 Description The issue allows authenticated attackers with Subscriber-level access and above to extract sensitive information from the...

D-Link DAP-1620 安全漏洞

The D-Link DAP-1620 is a wireless repeater extender from D-Link. The D-Link DAP-1620 suffers from a stack buffer overflow vulnerability. The vulnerability stems from improper handling of the parameter uid and can be exploited by an attacker to trigger a denial of service or execute malicious code...

SourceCodester Kortex Lite Advocate Office Management System 注入漏洞

SourceCodester Kortex Lite Advocate Office Management System is a SourceCodester open source office management system. An injection vulnerability exists in SourceCodester Kortex Lite Advocate Office Management System version 1.0, which stems from improper manipulation of the ID parameter in the...

CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...

CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...

anything-llm 输入验证错误漏洞

anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. An input validation error vulnerability exists in versions prior to anything-llm 1.2.2, which stems from the presence of Prisma injection in the API endpoint /embed/:embedId/stream-chat, which allows an...

PT-2025-12178 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: The issue is related to improper access control. Administrators are supposed to view only the chats of non-admin members on the frontend admin page. However, it is possible to view the chats o...

WordPress AHAthat Plugin plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter vulnerability

Authenticated Administrator+ SQL Injection via id Parameter vulnerability discovered by Régis SENET in WordPress Plugin AHAthat versions = 1.6...

WordPress plugin AHAthat Plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

CVE-2025-2511: Improper Neutralization of Special Elements used in an SQL Command

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

Online Class and Exam Scheduling System activate.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. The Online Class and Exam Scheduling System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter id of /pages/activate.php. An...

Online Class and Exam Scheduling System salut_del.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. The Online Class and Exam Scheduling System suffers from a SQL injection vulnerability that originates from the parameter id of /pages/salutdel.php that lacks validation of externally entered SQL statements. An...

PT-2025-11677

Name of the Vulnerable Software and Affected Versions AHAthat Plugin versions up to, and including, 1.6 Description The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing...

PT-2025-11634

Name of the Vulnerable Software and Affected Versions Systemic Risk Value versions =2.8.0 Description The issue concerns improper access control. Specifically, in the /RiskValue/GroupingEntities/Controls/GetFile.aspx endpoint, the ID parameter is predictable and numerical, allowing unauthorized...

CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...

CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...