WukongCRM 安全漏洞

WukongCRM is a Customer Relationship Management CRM system from China Wukong Wukong. A security vulnerability exists in WukongCRM version 9.0, which stems from a cross-site request forgery issue that could lead to unauthorized operations...

OpenC3 COSMOS 安全漏洞

OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to v6.0.2, which stems from the disclosure of service credentials stored in an environment variable, which could lead to an attacker accessing the credentials...

CVE-2025-43866

Vantage6 Server JWT secret not cryptographically secure: the auto-generated key uses UUID1, which is partially predictable. This exposes potential forgery of security tokens. The issue is fixed in version 4.11.0; upgrading to 4.11.0+ or defining a custom JWT secret in configuration mitigates the ...

Important: dotnet8.0

Issue Overview: External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. CVE-2025-26646 Affected Packages: dotnet8.0 Issue Correction: Run dnf update dotnet8.0 --releasever 2023.7.20250609 to...

CVE-2025-48141 WordPress Multi CryptoCurrency Payments <= 2.0.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alex Zaytseff Multi CryptoCurrency Payments allows SQL Injection. This issue affects Multi CryptoCurrency Payments: from n/a through 2.0.3...

CLSA-2025-1749481543 mysql: Fix of 20 CVEs

Update to MySQL 8.0.42 - CVEs fixed: CVE-2025-21574 CVE-2025-21577 CVE-2025-21579 CVE-2025-21581 CVE-2025-21584 CVE-2025-21585 CVE-2025-30681 CVE-2025-30682 CVE-2025-30683 CVE-2025-30684 CVE-2025-30688 CVE-2025-30689 CVE-2025-30695 CVE-2025-30696 CVE-2025-30699 CVE-2025-30703 CVE-2025-30705...

CVE-2025-49315

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows SQL Injection.This issue affects Persian Woocommerce SMS: from n/a through = 7.0.10...

VulnCheck KEV: CVE-2023-41599

An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal...

OpenHarmony 安全漏洞

OpenHarmony is an open source project of a kind of Hongmeng operating system from the OpenAtom OpenAtom Foundation in China. A security vulnerability exists in OpenHarmony v5.0.3 and earlier versions that stems from type confusion and could cause an application to crash...

CVE-2025-49445 WordPress Interactive UK Regional Map plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through = 2.0...

CVE-2025-28954

CVE-2025-28954 (Backwp) is a CSRF vulnerability in the Backwp plugin for WordPress, affecting versions up to 2.0.2. The CVSS 3.1 base score is 7.4 (HIGH) with network access, require user interaction, and impact limited to availability (C) with availability impact HIGH. Root cause and exact explo...

CVE-2025-30938 WordPress Broadly for WordPress plugin <= 3.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in broadly Broadly for WordPress broadly allows Stored XSS.This issue affects Broadly for WordPress: from n/a through = 3.0.2...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS version 5.0.0 suffers from a security vulnerability, no details of the vulnerability are provided at this time...

CVE-2025-46257 WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the QuerySubscribers function. An attacker can escalate privileges by injecting malicious SQL commands. Remediation Upgrade github.com/knadh/listmonk/models to version 5.0.0 or higher. References - GitHub Commit - POC...

PHPGurukul Teacher Subject Allocation Management System 注入漏洞

Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter editid in fi...

PHPGurukul Hospital Management System 代码注入漏洞

Hospital Management System a PHP and MySQL based hospital management system. Hospital Management System has a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the parameter patname in the file /doctor/edit-patient.php,...

CVE-2025-46204

An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/id endpoint...

DALIBO PostgreSQL Anonymizer 安全漏洞

DALIBO PostgreSQL Anonymizer is an extension for masking or replacing personally identifiable information PII or commercially sensitive data in PostgreSQL databases from France DALIBO. A security vulnerability exists in DALIBO PostgreSQL Anonymizer version v2.0 and v2.1, which stems from a...

Arbitrary Code Injection

Overview org.hibernate.validator:hibernate-validator is a Hibernate Validator Engine Relocation Artifact. Affected versions of this package are vulnerable to Arbitrary Code Injection due to the interpolation of user-supplied input in constraint violation messages with Expression Language. An...