12256 matches found
The vulnerability of the OU History Report component of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus allows a malicious actor to execute custom requests and gain access to the database table records.
The vulnerability of the OU History Report component of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute...
The vulnerability of the cpp-httplib library in the C++ programming language allows a hacker to cause a service failure.
The vulnerability of the cpp-httplib library in the C++ programming language is related to an uncontrolled consumption of resources. Exploiting this vulnerability may allow a malicious actor to cause service failures...
CVE-2025-66916
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing...
CVE-2025-8306
CVE-2025-8306 affects Asseco InfoMedica. A low-privilege user can obtain encoded passwords of other accounts due to weak access control, enabling chained Privilege Escalation with CVE-2025-8307. Affected versions are fixed in 4.50.1 and 5.38.0. The linked advisories describe an improper access-co...
CVE-2025-66916
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing...
CVE-2025-66916
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier is vulnerable to arbitrary file reading and writing. The root cause is the failure to filter user input when executing QLExpress expressions through the /snail-job/workflow/check-node-expression interface. Attackers can exploit t...
PT-2026-1867
Name of the Vulnerable Software and Affected Versions RuoYi-Vue-Plus versions 5.5.1 and earlier Description The snailjob component in RuoYi-Vue-Plus does not filter user input when executing QLExpress expressions through the /snail-job/workflow/check-node-expression API endpoint. This allows...
CVE-2025-66916: Improper Control of Generation of Code
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing...
CVE-2025-66916
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing...
CVE-2025-66916
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing...
RuoYi-Vue-Plus 安全漏洞
RuoYi-Vue-Plus is a development framework from the Chinese organization dromara. A security vulnerability exists in RuoYi-Vue-Plus 5.5.1 and earlier versions, which stems from unfiltered user input and could lead to arbitrary file reading and writing...
10,000 WordPress Sites Protected Against Site Reset and Privilege Escalation Vulnerability in Demo Importer Plus WordPress Plugin
On November 27th, 2025, we received a submission for a Site Reset and Privilege Escalation vulnerability in Demo Importer Plus, a WordPress plugin with more than 10,000 active installations. This vulnerability can be leveraged to trigger a full site reset and assign the administrator role to the...
CVE-2025-46434
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro thepluselementoraddon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through 6.3.7...
CVE-2025-46434
CVE-2025-46434 corresponds to a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin "The Plus Addons for Elementor Pro" (prior to v6.3.7). The issue arises from incorrectly configured access control levels, enabling unauthorized access to actions or data that shoul...
CVE-2025-46434 WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro thepluselementoraddon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through 6.3.7...
Major Data Breach Hits Company Operating 150 Gas Stations in the US
Texas based Gulshan Management Services, operator of Handi Plus and Handi Stop gas stations, reports a data breach impacting over 377,000 people...
CVE-2022-27496
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2019-16268
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...