Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the createVerify function when using HS256 HMAC algorithms and incorporating user-provided data from the JSON Web Signature Protected Header or Payload in HMAC secret lookup routines...

CVE-2025-14005

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=0 of the component Add Display Name Field. Executing a manipulation of the argument dataname can lead t...

mall-swarm 授权问题漏洞

mall-swarm is a microservice mall system. An authorization issue vulnerability exists in mall-swarm, which stems from incorrect manipulation of the parameter ids in the file /member/readHistory/delete, for which no detailed vulnerability details are provided at this time...

PT-2025-49114

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed...

PT-2025-49171

Name of the Vulnerable Software and Affected Versions youlaitech youlai-mall versions 1.0.0 through 2.0.0 Description A flaw exists in youlaitech youlai-mall versions 1.0.0 through 2.0.0 related to improper control of dynamically-identified variables. The issue is present in the getById,...

CVE-2025-54065 GZDoom engine allows arbitrary code execution via ZScript actor states

GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling allows scripts to read arbitrary addresses, write constants into the JIT-compiled code section, and redirect control flow through crafted...

BIT-ACTIVEMQ-2021-21344 XStream is vulnerable to an Arbitrary Code Execution attack

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who follow...

CVE-2025-13948

The CVE-2025-13948 entry concerns opsre go-ldap-admin (up to 20251011) with an issue in the JWT Handler’s docs/docker-compose/docker-compose.yaml processing. Manipulating the argument secret key can lead to use of a hard-coded cryptographic key, enabling remote attack. Exploitation details beyond...

CVE-2025-13948 opsre go-ldap-admin JWT docker-compose.yaml hard-coded key

A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-compose/docker-compose.yaml of the component JWT Handler. Executing manipulation of the argument secret key can lead to use of hard-coded cryptographic key . Th...

CVE-2025-12358 ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

CVE-2025-12358 ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

WordPress ShopEngine plugin <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation vulnerability

Cross-Site Request Forgery to Wishlist Manipulation vulnerability discovered by Adrian Lukita in WordPress Plugin ShopEngine versions = 4.8.5...

Laravel File Manager 安全漏洞

Laravel File Manager is a Laravel file manager by Aleksandr Manekin Personal Developer. A security vulnerability exists in Laravel File Manager 3.3.1 and earlier versions, which stems from a directory traversal in the zip archive feature that could lead to arbitrary file manipulation...

PT-2025-48812

A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-compose/docker-compose.yaml of the component JWT Handler. Executing manipulation of the argument secret key can lead to use of hard-coded cryptographic key . Th...

The vulnerability of the tls_offload_ctx_tx() function in the include/net/tls.h module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the tlsoffloadctxtx function in the include/net/tls.h module of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vulnerability of the enetc_sriov_configure() function in the drivers/net/ethernet/freescale/enetc/enetc_pf.c module – The driver for supporting Ethernet adapter devices in the Freescale Linux operating system, which allows a hacker to cause a service failure.

Vulnerability of the enetcsriovconfigure function in the drivers/net/ethernet/freescale/enetc/enetcpf.c module – The driver for supporting Ethernet adapter devices in the Freescale Linux operating system relies on pointer swapping. Exploiting this vulnerability could allow an attacker to cause a...

Vulnerability of the intel_hdcp_read_valid_bksv() function in the driver/gpu/drm/i915/display/intel_hdcp.c module – This driver is part of the Linux kernel’s Direct Rendering Infrastructure (DRI) support mechanism. An attacker can exploit this vulnerability to cause a service failure.

Vulnerability of the intelhdcpreadvalidbksv function in the driver/gpu/drm/i915/display/intelhdcp.c module – The Linux DRI driver is vulnerable due to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the afs_wait_for_operation() function in the fs/afs/fs_operation.c module of the Andrew File System support module in the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the afswaitforoperation function in the fs/afs/fsoperation.c module of the Andrew File System support module in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vulnerability of the amd_pstate_adjust_perf() function in the drivers/cpufreq/amd-pstate.c module – The driver for scaling CPU core frequency in Linux operating systems, which can be exploited by attackers to cause system failures.

Vulnerability of the amdpstateadjustperf function in the drivers/cpufreq/amd-pstate.c module – The driver for scaling CPU frequency in Linux operating systems is vulnerable due to a pointer manipulation issue. Exploiting this vulnerability could allow an attacker to cause system failures...

Vulnerability of the dcn21_set_abm_immediate_disable() function in the drivers/gpu/drm/amd/display/dc/dcn21/dcn21HWSeq.c module – This driver supports AMD graphics card infrastructure for direct rendering in Linux operating systems. It allows attackers to cause service failures.

Vulnerability of the dcn21setabmimmediatedisable function in the drivers/gpu/drm/amd/display/dc/dcn21/dcn21HWSeq.c module – Drivers that support Direct Rendering Infrastructure DRI for AMD graphics cards in Linux operating systems are vulnerable due to a pointer manipulation issue. Exploiting thi...