PT-2025-33482 · Joomla +1 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin versions 1.3.2 through 1.4.4 Description: A SQL injection vulnerability in the JS Jobs plugin for Joomla allows low-privilege users to execute arbitrary SQL commands. Recommendations: Update the JS Jobs plugin to a version late...

CVE-2025-52361

CVE-2025-52361 affects AK-Nord USB-Server-LXL Firmware up to v0.0.16 Build 2023-03-13. The root cause is insecure permissions on the /etc/init.d/lighttpd script, which is executed with root privileges during system boot and on any interaction. A locally authenticated low-privilege user can modify...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-49484 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

PT-2025-30021 · Joomla · Js Jobs Plugin

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin for Joomla versions 1.0.0 through 1.4.1 Description: A SQL injection vulnerability in the JS Jobs plugin for Joomla allows low-privilege users to execute arbitrary SQL commands via the cvid parameter in the employee application...

SAP NetWeaver和SAP ABAP Platform 安全漏洞

SAP NetWeaver and SAP ABAP Platform are both products of SAP, a German company.SAP NetWeaver is an integrated service-oriented application platform. SAP NetWeaver is an integrated service-oriented application platform that provides a development and runtime environment for SAP applications.SAP AB...

CVE-2025-5141 Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache

A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager BoKS on versions 7.2.0 up to 7.2.0.17, 8.1.0 up to 8.1.0.22, 8.1.1 up to 8.1.1.7, 9.0.0 up to 9.0.0.1 and also legacy tar installs of BoKS 7.2 without hotfix 0474 on Linux, AIX, and Solaris allows low privilege...

CVE-2025-5141

CVE-2025-5141 affects Fortra’s Core Privileged Access Manager (BoKS). The flaw is in the BoKS Server Agent component, allowing low-privilege local users to dump data from the cache. Affected versions: BoKS 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1...

CVE-2025-5141 Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache

A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager BoKS on versions 7.2.0 up to 7.2.0.17, 8.1.0 up to 8.1.0.22, 8.1.1 up to 8.1.1.7, 9.0.0 up to 9.0.0.1 and also legacy tar installs of BoKS 7.2 without hotfix 0474 on Linux, AIX, and Solaris allows low privilege...

PT-2025-25755 · Fortra · Ca Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: Fortra's Core Privileged Access Manager BoKS versions 7.2.0 through 7.2.0.17 Fortra's Core Privileged Access Manager BoKS versions 8.1.0 through 8.1.0.22 Fortra's Core Privileged Access Manager BoKS versions 8.1.1 through 8.1.1.7 Fortra's Cor...

CVE-2023-2921 Short URL <= 1.6.8 - Subscriber+ SQLi

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers...

CVE-2024-3448

Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port...

CVE-2023-0876

The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability...

CVE-2023-6048

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset...

CVE-2023-6485

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against hi...

CVE-2023-5098

The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges like subscribers from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS...

CVE-2023-4776

The School Management System WordPress plugin before 2.2.5 uses the WordPress escsql function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers...

CVE-2023-39909

Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application...

CVE-2023-2078

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...