CVE-2025-66723: Incorrect Permission Assignment for Critical Resource

inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths...

CVE-2025-56332: Initialization of a Resource with an Insecure Default

Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration...

CVE-2025-66723

inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths...

CVE-2025-66723

inMusic Brands Engine DJ versions >=3.0.0 and

PT-2025-54227

Name of the Vulnerable Software and Affected Versions inMusic Brands Engine DJ version 4.3.0 Description Engine DJ version 4.3.0 is affected by an issue with insecure permissions. An exposed HTTP service within the Remote Library feature allows attackers to access all files and network paths...

CVE-2025-56332

Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration...

CVE-2025-66723

inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths...

CVE-2024-27480

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload...

Insecure Direct Object Reference (IDOR) in LollMS Friend Request Response

Executive Summary A critical security vulnerability has been identified in LollMS that allows any authenticated user to accept or reject friend requests belonging to other users. The respondrequest function lacks authorization checks, enabling Insecure Direct Object Reference IDOR attacks. Affect...

WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme FiveStar versions = 1.7...

WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Struktur versions = 2.5.1...

EUVD-2025-205576

A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/search-invoices.php. Executing manipulation of the argument searchdata can lead to cross site scripting. The attack can be launched remotely...

CVE-2025-67729

LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load is called without the weightsonly=True parameter when loading model checkpoint files. This allows an attacker to execute...

CVE-2025-68927

Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/id/notes, the backend automatically wraps user input in tags. However, by intercepting the...

CVE-2024-27480: Unrestricted Upload of File with Dangerous Type

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload...

CVE-2024-27480

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload...

CVE-2024-27480

CVE-2024-27480 involves givanz VvvebJs, version 1.7.2, which is vulnerable to an Insecure File Upload. The connected Red Hat/NVD entries confirm this specific version is affected and that the vulnerability can impact confidentiality, integrity, and availability (per CVSS 3.1 metrics: AV:N/AC:L/PR...

CVE-2024-27480

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload...

The vulnerability of the Sprecher SPRECON-E automation module’s microprogramming software, related to insufficiently secure data encryption, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the microprogramming software of the automation module Sprecher SPRECON-E is related to insufficiently secure data encryption. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2025-53791

Name of the Vulnerable Software and Affected Versions givanz VvvebJs version 1.7.2 Description givanz VvvebJs version 1.7.2 is susceptible to Insecure File Upload. This allows for the potential upload of malicious files. Recommendations At the moment, there is no information about a newer version...