PT-2025-31853 · Macrium · Macrium Reflect

Name of the Vulnerable Software and Affected Versions: Macrium Reflect versions through 2025-06-26 Description: Macrium Reflect allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file. The attack involves placing a renamed executable in...

CVE-2025-53394

Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and...

CVE-2025-8213

The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscanajaxquarantine' and 'nscanquarantineselect' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated...

CVE-2025-8213

The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscanajaxquarantine' and 'nscanquarantineselect' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated...

CVE-2025-8213

CVE-2025-8213 concerns the NinjaScanner plugin for WordPress. The issue is an authenticated arbitrary file deletion vulnerability caused by insufficient file path validation in the nscan_ajax_quarantine and nscan_quarantine_select functions. It affects all versions up to and including 3.2.5, and ...

CVE-2025-8213 NinjaScanner – Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion

The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscanajaxquarantine' and 'nscanquarantineselect' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated...

CVE-2025-50185

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

Salesforce Tableau 安全漏洞

Salesforce Tableau is a data visualization and analytics platform from Salesforce, Inc. A security vulnerability exists in Salesforce Tableau versions prior to 2025.1.3, prior to 2024.2.12, and prior to 2023.3.19, which stems from insufficient path validation and could lead to path traversal...

Server Side Request Forgery (SSRF)

org.glassfish.main.admingui, console-common is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of user-supplied URLs in specific endpoints, which allows an attacker to make arbitrary requests to internal or external systems on behalf of the server...

PT-2025-30373

Name of the Vulnerable Software and Affected Versions Website Contact Form With File Upload for WordPress versions up to 1.3.4 Description The Website Contact Form With File Upload plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation within the...

PT-2025-30372

Name of the Vulnerable Software and Affected Versions FoxyPress versions up to 0.4.2.1 Description The FoxyPress plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation in the uploadify.php file. This allows unauthenticated attackers to upload...

Open Redirect

@dirac-grid/diracx-web-components is vulnerable to Open Redirect. The vulnerability is due to insufficient validation of redirect URIs caused by the login page accepting arbitrary unverified URLs in the redirect field, which can be abused with parameter pollution to conceal malicious destinations...

CVE-2025-24938 Insufficient Validation of Input while user creation

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access administrator to the application has the potential execute commands on the operating system under the context of the webserver. The vulnerable...

CVE-2025-24938

CVE-2025-24938 is a command-injection flaw in Nokia WaveSuite NOC (Wavesuite Noc) web application. The issue arises when unfiltered user input is passed to a system command during user creation in User Management, allowing an attacker with high (administrative) privileges to execute commands on t...

CVE-2025-24936 Insufficient Validation of Input in the URL

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to th...

CVE-2025-20284

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials coul...

CVE-2025-5393

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the aloneimportpackrestoredata function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated...

CVE-2025-7712 Madara - Core <= 2.2.3 - Unauthenticated Arbitrary File Deletion

The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpmangadeletezip function in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2025-20272

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-20272 Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection Vulnerability

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied...