CVE-2025-1980

CVE-2025-1980 concerns the Ready_ application where the Profile section allows uploading files of any type/extension without restriction. If the server is misconfigured (as noted around 2021–2022 deployments), this can lead to Remote Code Execution. The (NVD) entry lists a CRITICAL impact with CV...

CVE-2025-1980 Remote Code Execution via Unrestricted File Upload in Ready_

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

CVE-2025-1980 Remote Code Execution via Unrestricted File Upload in Ready_

The Ready application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for...

Zulip 授权问题漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. An authorization issue vulnerability exists in versions prior to Zulip 10.2, which stems from a single sign-on...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions 5.0 through 16.7.1, which stems from a misconfiguration of the message flow and could lead to information disclosure...

WordPress Real Estate Manager plugin <= 7.3 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by theviper17 in WordPress Plugin Real Estate Manager versions = 7.3...

CVE-2023-5616

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user...

Dell Trusted Device 访问控制错误漏洞

Dell Trusted Device is an application from Dell USA. An elevation of privilege vulnerability exists in Dell Trusted Device, which stems from a misconfiguration of the default privileges and can be exploited by an attacker to elevate privileges...

WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by astra.r3verii in WordPress Plugin Material Dashboard versions = 1.4.6...

Exposure of Resource to Wrong Sphere

Overview jupyter-remote-desktop-proxy is a Run a desktop environments on Jupyter Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the setupwebsockify function, due to the improper configuration of the TigerVNC server, when it as opposed to TurboVNC is th...

WordPress WPJobBoard plugin < 5.11.1 - Path Traversal vulnerability

Path Traversal vulnerability discovered by Ananda Dhakal in WordPress Plugin WPJobBoard versions 5.11.1...

Moodle 4.3.x < 4.3.3 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.10, or 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities. - Actions in the admin management of analytics models did not include the necessary tok...

WordPress plugin Flo Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-26888

CVE-2025-26888 is a Missing Authorization vulnerability in WooCommerce Multilingual & Multicurrency with WPML (affected: WooCommerce Multilingual & Multicurrency

WordPress Squeeze plugin <= 1.6 - Full Path Disclosure (FPD) vulnerability

Full Path Disclosure FPD vulnerability discovered by astra.r3verii in WordPress Plugin Squeeze versions = 1.6...

WordPress Simple Post Meta Manager Plugin <= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerability

CSRF to Reflected Cross-Site Scripting vulnerability discovered by thiennv in WordPress Plugin Simple Post Meta Manager versions = 1.0.9...

WordPress Accessibility Suite plugin <= 4.18 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by theviper17 in WordPress Plugin Accessibility Suite versions = 4.18...

📄 Appsmith Remote Code Execution

An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

CVE-2025-32178

Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 6Storage Rentals: from n/a through = 2.22.0...

CVE-2025-2798

The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom...