RSA Security RSA Archer 安全漏洞

RSA Security RSA Archer is an enterprise IT governance and compliance governance product from RSA Security, including policy, risk and compliance definition and management. It is capable of aggregating all of our enterprise assets, as well as some of the monitored information, and organizing it...

DECE Software Geodi 跨站脚本漏洞

DECE Software Geodi is an AI and NLP-powered data discovery, classification, and search platform from DECE Software, UK. DECE Software Geodi suffers from a cross-site scripting vulnerability that stems from improper input neutralization and could lead to a cross-site scripting attack...

CVE-2025-38497 usb: gadget: configfs: Fix OOB read on empty string write

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qwsign' or 'landingPage' sysfs attributes, the store functions attempt to access pagel - 1 before validating that the length 'l' is...

Improper Neutralization of Input Used for LLM Prompting

Overview @google/gemini-cli is a Gemini CLI Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting due to an improper implementation of the getCommandRoot and isCommandAllowed functions. An attacker can inject malicious commands by leveraging...

Exploit for OS Command Injection in Gnu Bash

This is an extension for Burp Suite, a web application security testing tool. The extension, named "ActiveScan++", extends Burp's active and passive scanning capabilities to identify application behavior that may be of interest to advanced testers. It includes checks for potential host header...

WordPress plugin Educenter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Hybridauth 安全漏洞

Hybridauth is a web-based authentication and authorization software from Hybridauth open source. A security vulnerability exists in Hybridauth versions 2.0.9 through 2.2.2, which stems from an install.php script that does not properly clean up its inputs, which could lead to remote code execution...

Simopro Technology WinMatrix3 Cross-Site Scripting Vulnerability

Simopro Technology WinMatrix3 is an IT resource management system for enterprise-class computer asset management, endpoint security control and IT operations management. Simopro Technology WinMatrix3 suffers from a cross-site scripting vulnerability that stems from the application's lack of...

Remote Code Execution (RCE)

dolibarr/dolibarr is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input handling caused by insecure mechanisms that allow arbitrary command execution and access to sensitive files on the file system...

Calibre-Web 操作系统命令注入漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database by Jan B, a personal developer. An operating system command injection vulnerability exists in Calibre-Web version 0.6.24, which stems from improper neutralization of special elements and could...

Security Bulletin: IBM watsonx Code Assistant On Prem product impacted by Input Handling Vulnerability in Transformers 4.49.0

Summary A vulnerability CVE-2025-1194 has been identified in the Transformers Python package version 4.49.0, which impacts the IBM watsonx Code Assistant On-Premises product. The issue arises from improper input validation during model configuration loading, which may allow attackers to execute...

WordPress JetBlocks For Elementor Cross-Site Scripting Vulnerability

WordPress JetBlocks For Elementor is an enhancement plugin designed specifically for Elementor to extend the functionality of your WordPress website. WordPress JetBlocks For Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be...

Weidmueller多款产品 操作系统命令注入漏洞

The Weidmueller IE-SR-2TX-WL, among others, is an industrial-grade security router from Weidmueller, Germany. An operating system command injection vulnerability exists in several Weidmueller products. The vulnerability stems from improper cleanup of user input in the main web interface, which...

WordPress Responsive Addons for Elementor Cross-Site Scripting Vulnerability

WordPress Responsive Addons for Elementor is a free plugin that provides 80+ Elementor widgets and 150+ templates with support for 250+ pre-built page modules. WordPress Responsive Addons for Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization...

WordPress JetTabs Cross-Site Scripting Vulnerability

WordPress JetTabs is a plugin for Elementor page builder, mainly used to add stylish tabs and tabs functionality to WordPress websites, supports building rich content and customizing styles through Elementor widgets. WordPress JetTabs suffers from a cross-site scripting vulnerability that stems...

WordPress SMTP for Amazon SES SQL Injection Vulnerability

WordPress SMTP for Amazon SES is a plugin or configuration solution for sending emails via Amazon Simple Email Service in WordPress sites. WordPress SMTP for Amazon SES suffers from a SQL injection vulnerability that stems from improper input neutralization, and no detailed vulnerability details...

WordPress JetSearch Cross-Site Scripting Vulnerability

WordPress JetSearch is an AJAX-based search plugin for WordPress , designed for Elementor editor , providing a fast , flexible and beautiful search experience . WordPress JetSearch suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be...

WordPress JetTricks Cross-Site Scripting Vulnerability

WordPress JetTricks is a plugin developed for WordPress to enhance the Elementor page builder. WordPress JetTricks suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be exploited by an attacker to trigger the execution of malicious scripts b...

WordPress Invico-WordPress Consulting Business Theme Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Invico-WordPress Consulting Business Theme, which stems from improper handling of inputs during web page generation...

WordPress FG Drupal to WordPress Cross-Site Request Forgery Vulnerability

WordPress FG Drupal to WordPress is a plugin tool for migrating Drupal website content to WordPress, which supports the import of basic content such as articles, images, etc., but the free version does not include the comment import function. WordPress FG Drupal to WordPress suffers from a...