17617 matches found
Jenkins User Registration Form Detected
Jenkins is an open-source automation server used to automate various aspects of software development, including building, testing, and deploying applications. An internal only Jenkins instance may be misconfigured to allow user registration, potentially leading to attackers creating accounts and...
PT-2025-39199
Name of the Vulnerable Software and Affected Versions DNN formerly DotNetNuke versions prior to 10.1.0 Description DNN is an open-source web content management platform. The CKEditor file upload endpoint lacks sufficient filename sanitization, potentially allowing network endpoint probing. A...
CVE-2025-59527
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery SSRF vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise serve...
CVE-2025-59527
Flowise (FlowiseAI/Flowise) version 3.0.5 contains a Server-Side Request Forgery (SSRF) in the /api/v1/fetch-links endpoint. The issue allows the Flowise server to proxy requests into internal network services and enumerate internal links. It has been patched in version 3.0.6; upgrading to 3.0.6 ...
CVE-2025-59527 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery SSRF vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise serve...
CVE-2025-59527 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery SSRF vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise serve...
CVE-2025-59527 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery SSRF vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise serve...
CVE-2025-57430
Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials...
CVE-2025-57430
Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials...
CVE-2025-9949
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...
CVE-2025-57430
Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials...
CVE-2025-57430
The CVE-2025-57430 affects Creacast Creabox Manager 4.4.4, where a publicly accessible /get endpoint leaks internal configuration data, including the creacodec.lua file that contains plaintext admin credentials. This exposes sensitive configuration details and credential data via network access. ...
CVE-2025-34201
Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments run many Docker containers on shared internal networks without firewalling or segmentation between instances. A compromise of any single container allows direct access to internal services HTTP, Redi...
CVE-2025-34199
Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 VA and SaaS deployments contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal...
CVE-2025-59344
AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery SSRF vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows...
CVE-2025-10458
Parameters are not validated or sanitized, and are later used in various internal operations...
CVE-2025-9949
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...
CVE-2025-9949 Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...
CVE-2025-9949 Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...
CVE-2025-9949
CVE-2025-9949 (Internal Links Manager for WordPress) is a CSRF vulnerability present in all versions up to 3.0.1 due to missing or incorrect nonce validation in the link deletion path (process_bulk_action). This allows unauthenticated attackers to delete SEO links by tricking an administrator int...