EPICOR Prophet 21 安全漏洞

EPICOR Prophet 21 is an enterprise resource planning software from EPICOR, Inc. that is used for enterprise resource management, pricing, and other operations. A security vulnerability exists in EPICOR Prophet 21 version 23.2.5232 and prior versions, which stems from uncleaned user input fields a...

WordPress plugin ZoomSounds 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

USN-7319-1 cmark-gfm vulnerabilities

It was discovered that cmark-gfm's autolink extension did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2022-39209 It was discovered that cmark-gfm did not...

WordPress plugin Tabs for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code issue vulnerability...

UBUNTU-CVE-2022-49424

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer dereference when printing devname When larbdev is NULL in the case I hit, the node is incorrectly set iommus = , it will cause devicelinkadd fail and kernel crashes when we try to print...

CVE-2024-12038 Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyformsnav' shortcode in all versions up to, and including, 2.8.15 due to insufficient input...

postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

Security update for postgresql13

This update for postgresql13 fixes the following issues: Upgrade to 13.20: CVE-2025-1094: Harden PQescapeString and allied functions against invalidly-encoded input strings bsc1237093. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

CVE-2024-13534

CVE-2024-13534 affects the WordPress plugin “Small Package Quotes – Worldwide Express Edition.” The issue is an unauthenticated SQL Injection via the edit_id and dropship_edit_id parameters in all versions up to and including 5.2.18, stemming from insufficient escaping and inadequate preparation ...

The vulnerability of the setSSServer() function in the cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the setSSServer function in the cstecgi.cgi script of the TOTOLINK X5000R router’s software is related to the lack of measures to sanitize input data when processing parameters such as password, port, and timeout. Exploiting this vulnerability could allow an attacker to execu...

CVE-2024-13578

The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

SUSE CVE-2024-11236

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, uncontrolled long string inputs to ldapescape function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write...

CVE-2024-36673

Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries...

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()

A flaw was found in Django. Processing very large inputs with a specific sequence of characters with the urlize and urlizetrunc functions can cause a denial of service...

PrestaShop 跨站脚本漏洞

PrestaShop is an open source e-commerce solution from the US company PrestaShop. The program provides multiple payment methods, SMS alerts and product image zoom and other features. A cross-site scripting vulnerability exists in PrestaShop version 8.1.7, which stems from missing validation of lin...

CVE-2025-1126

A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client...

CVE-2025-1126 Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).

A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client...

CVE-2025-1126

CVE-2025-1126 relates to Lexmark Print Management Client and is described as a vulnerability due to reliance on untrusted inputs in a security decision. The primary sources (NVD/NSSI) indicate a CVSS v3.1 base score of 9.3 (CRITICAL) with LOCAL attack vector, LOW attack complexity, and NONE privi...

CVE-2025-1126 Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).

A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client...

CVE-2025-1182

A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfdelfrelocsymboldeletedp of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an atta...