CVE-2025-12781

When passing data to the b64decode, standardb64decode, and urlsafeb64decode functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. Th...

CVE-2025-12781

CVE-2025-12781 concerns the base64 module in Python, where b64decode(), standard_b64decode(), and urlsafe_b64decode() historically accept the characters "+/" regardless of the altchars parameter. The connected sources confirm this behavior and note that newer RFCs recommend restricting to the spe...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the b64decode, standardb64decode, and urlsafeb64decode functions when the altchars parameter is used. An attacker can cause logical errors or compromise data integrity by submitting input containi...

CVE-2025-68135

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by the TbdController loop, leading to its caller and itself to silently terminates. Thus, this leads to a denial of service as it is responsible of SDP and ISO15118-20 servers...

CVE-2025-68135

EVerest (EV charging software stack) prior to version 2025.10.0 has a vulnerability in the TbdController loop where C++ exceptions are not properly handled, causing the loop and its caller to terminate silently and leading to a denial of service affecting SDP and ISO15118-20 servers. The issue is...

CVE-2021-47883

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions durin...

CVE-2021-47883 Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions durin...

CVE-2021-47883

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions durin...

CVE-2021-47883 Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions durin...

CVE-2021-47883

Sandboxie Plus 0.7.2 has an unquoted service path in the SbieSvc service, allowing local attackers to execute code with LocalSystem privileges during startup by injecting a malicious executable. Exploitation details are not provided in the supplied documents, and no patch/fix version is specified...

EUVD-2026-3624

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions durin...

PT-2026-3834

Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions durin...

Sandboxie Plus code issue and vulnerabilities

Sandboxie Plus is an open-source Windows sandboxing tool developed by Sandboxie Plus. Version 0.7.2 of Sandboxie Plus has a code vulnerability; this vulnerability stems from a service path in the SbieSvc service that lacks quotation marks, which may allow local attackers to execute code with...

CPython security vulnerabilities

CPython is a Python interpreter implemented in C language by the Python Foundation. CPython has security vulnerabilities, where functions such as b64decode, standardb64decode, and urlsafeb64decode always accept the + and/or character, which may lead to data integrity issues...

WordPress Demo Importer Plus plugin <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload vulnerability

Authenticated Author+ Blind XML External Entity Injection via SVG File Upload vulnerability discovered by bosz in WordPress Plugin Demo Importer Plus versions = 2.0.9...

akasha-plus (>=0.3.0 <=0.3.17), akasha-terminal (>=0.8.0 <=0.8.72) +18 more potentially affected by CVE-2025-15536 via opencc (>=1.1.1 <=1.1.9)

opencc PYPI version =1.1.1, =0.3.0, =0.8.0, =0.1.0, =1.1.0, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-15536 Source advisory: SNYK:PYTHON-OPENCC-15874419...

CVE-2025-56451

Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main.do endpoint...

CVE-2025-14478

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

CVE-2025-14478

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...