PT-2025-2179 · Pirateforms · Contact Form & Smtp Plugin

Name of the Vulnerable Software and Affected Versions: The Contact Form & SMTP Plugin for WordPress by PirateForms versions up to, and including, 2.6.0 Description: The issue arises from the software allowing users to execute an action that does not properly validate a value before running do...

CVE-2024-48761

Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter...

CVE-2024-48761

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Celk Sistemas Celk Saude v.3.1.252.1 , a health sector management software. The flaw is caused by the improper validation or sanitization of the erro parameter, which is returned as a response when incorrect credentials are provided d...

PT-2025-2802 · Unknown · Celk Saude

Name of the Vulnerable Software and Affected Versions: Celk Saude version 3.1.252.1 Description: The issue arises from improper validation or sanitization of the erro parameter, which is returned as a response when incorrect credentials are entered during login. This makes the component susceptib...

CVE-2024-48761

Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter...

CVE-2024-48761

Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter...

Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in privilege escalation (CVE-2024-49824).

Summary IBM Robotic Process Automation could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation of client-side security enforcement. This bulletin identifies the fixes required to address the vulnerability. Vulnerability Details...

Security Bulletin: IBM Maximo Application Suite uses serve-static-1.15.0.tgz, send-0.18.0.tgz and cryptography-43.0.0-cp39-abi3-manylinux_2_28_x86_64.whl which is vulnerable to CVE-2024-43800 CVE-2024-43799 CVE-2024-6119.

Summary IBM Maximo Application Suite uses serve-static-1.15.0.tgz, send-0.18.0.tgz and cryptography-43.0.0-cp39-abi3-manylinux228x8664.whl which is vulnerable to CVE-2024-43800, CVE-2024-43799 and CVE-2024-6119. This bulletin contains information regarding the vulnerability and its fixture...

CVE-2025-24100: Improper Validation of Specified Quantity in Input

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access information about a user's contacts...

Local File Inclusion (LFI)

Ray is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper validation and access control in Ray's /static/ directory, which allows attackers to specify and access arbitrary file paths without authentication...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924

The Code Astro Internet banking system version 2.0.0 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is the lack of CSRF protection mechanisms on the account modification page (specifically pages_account.php ), allowing remote attackers to perform unauthorized ...

WordPress plugin AdForest 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Server-Side Request Forgery

Gomatrixserverlib is vulnerable to server-side request forgery SSRF. The vulnerability is due to improper validation of network requests, allowing the library to serve content from a private network it can access under certain conditions, which attackers can exploit to access internal network...

CVE-2024-49824

IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation...

CVE-2024-49824: Client-Side Enforcement of Server-Side Security

IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability in IBM Robotic Process Automation versions 21.0.0...

BIT-PYTHON-MIN-2024-11168 Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

CVE-2023-50738: Improper Validation of Integrity Check Value

A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified...

CVE-2025-20072 Mobile crash via improper validation of proto style in attachments

Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...