CVE-2025-11336 Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads...

CVE-2025-59830

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters...

AllStarLink Supermon 代码注入漏洞

AllStarLink Supermon is a web front-end management and monitoring tool from AllStarLink. A code injection vulnerability exists in AllStarLink Supermon 6.2 and earlier versions, which stems from unknown code in the AllMon2 component that could lead to a cross-site scripting attack...

EUVD-2025-31260

Malicious code in bioql PyPI...

EUVD-2023-58997

Malicious code in bioql PyPI...

EUVD-2025-29862

Malicious code in bioql PyPI...

EUVD-2025-28555

Malicious code in bioql PyPI...

EUVD-2022-34011

Malicious code in bioql PyPI...

EUVD-2025-27724

Malicious code in bioql PyPI...

EUVD-2025-25105

Malicious code in bioql PyPI...

EUVD-2025-28055

Malicious code in bioql PyPI...

EUVD-2025-28017

Malicious code in bioql PyPI...

EUVD-2025-30932

Malicious code in bioql PyPI...

EUVD-2025-31675

Malicious code in bioql PyPI...

EUVD-2025-32370

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-9895

The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the 'subscriber-list-empty.php' file. This makes it possible for unauthenticated attackers to empty the subscrib...

MeteoBridge template.cgi command injection

Added: 10/03/2025 CVE: CVE-2025-4008 Background MeteoBridge is a device which connects personal weather stations to public weather networks. Problem A command injection vulnerability in the MeteoBridge web interface could allow remote, unauthenticated attackers to execute arbitrary commands by...

ts3-manager 输入验证错误漏洞

ts3-manager is a web interface for maintaining the Teamspeak3 server by Jonathan Personal Developer. An input validation error vulnerability exists in ts3-manager version 2.2.1 and earlier, which stems from Unicode tagged characters not being handled correctly during the ASCII conversion process,...

Kissflow Work Platform 安全漏洞

Kissflow Work Platform is a low-code process automation platform from Kissflow, Inc. in the United States. A security vulnerability exists in Kissflow Work Platform versions v2.0 through v4.2, which originates from the injection of a specially crafted payload and could lead to a stored cross-site...

CVE-2025-8777 planetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter

The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...