28104 matches found
CVE-2025-14232
Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. : Satera LBP670C Series/Satera MF750C Series firmware v06.02...
CVE-2021-47788
WebsiteBaker 2.13.0 is affected by an authenticated remote code execution (RCE) vulnerability. The issue arises when users with language editing rights manipulate parameters in the language installation endpoint, allowing remote code execution on the server. No fix version is provided in the conn...
CVE-2021-47788
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code executi...
CVE-2021-47788 WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code executi...
CVE-2021-47788 WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code executi...
CVE-2025-65368
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...
CVE-2021-47758
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables...
CVE-2021-47766 Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)
Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate database queries. Attackers can exploit this vulnerability using boolean-based, error-based, and time-based blind SQL injection techniques to...
CVE-2026-0990
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a...
CVE-2025-14615
The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This makes it possible for...
PT-2026-3106
Name of the Vulnerable Software and Affected Versions SparkyFitness version 0.15.8.2 Description SparkyFitness is susceptible to Cross-Site Scripting XSS attacks. The issue stems from improper handling of user input and output from Large Language Models LLMs. This allows for the injection of...
PT-2026-3025
Name of the Vulnerable Software and Affected Versions Itflow versions through 25.06 Description An SQL injection issue exists in Itflow due to insufficient sanitization of integer parameters. Specifically, the "role id" parameter is vulnerable when editing a profile. An attacker with administrati...
Multi-Agent Taint Specification Extraction for Vulnerability Detection
Static Application Security Testing SAST tools using taint analysis are widely viewed as providing higher-quality vulnerability detection results compared to traditional pattern-based approaches. However, performing static taint analysis for JavaScript poses two major challenges. First,...
CVE-2025-65368
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...
AJAR: Adaptive Jailbreak Architecture for Red-Teaming
As Large Language Models LLMs evolve from static chatbots into autonomous agents capable of tool execution, the landscape of AI safety is shifting from content moderation to action security. However, existing red-teaming frameworks remain bifurcated: they either focus on rigid, script-based text...
Wolters Kluwer Kmaleon SQL injection vulnerability
Wolters Kluwer Kmaleon is an automated case management software developed by the German company Wolters Kluwer. Version 1.1.0.205 of Wolters Kluwer Kmaleon contains a SQL injection vulnerability. This vulnerability stems from the SQL injection in the tipocomb parameter of the kmaleonW.php file,...
PT-2026-3187
Name of the Vulnerable Software and Affected Versions Satera LBP670C Series/Satera MF750C Series versions v06.02 and earlier Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i...
CVE-2025-65368
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...
PT-2026-3160
Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.13.0 Description WebsiteBaker version 2.13.0 has a flaw that permits authenticated users with language editing rights to execute code remotely. This is possible through manipulation of parameters within the language...
