4160 matches found
CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server
Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...
CVE-2025-40630
IceWarp Mail Server ≤11.4.0 suffers an open redirect vulnerability. The issue is triggered by crafting malicious URLs that redirect users to arbitrary external domains (examples show vulnerable URL formats). Root cause is improper handling of target URLs leading to redirects. Affected product/ver...
CVE-2024-9831
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-11267
The JSP Store Locator WordPress plugin (versions 1.0 and earlier ) is vulnerable to a SQL injection attack. The root cause is a failure to sanitize and escape a parameter before using it in a SQL statement. This vulnerability allows a user with Contributor privileges to perform unauthorized SQL o...
WordPress plugin Twitter Bootstrap Collapse aka Accordian Shortcode 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Twitter Bootstrap Collapse ak...
WordPress plugin Payment Gateway for Telcell 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
Jenkins plugin Cadence vManager 安全漏洞
Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...
CVE-2025-47815
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflateread called indirectly from zipmemberreadall in zip-reader.c...
VulnCheck KEV: CVE-2024-11238
A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...
CVE-2023-51295
PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...
ApolloTheme AP Page Builder 路径遍历漏洞
ApolloTheme AP Page Builder is a plugin from ApolloTheme, Inc. A path traversal vulnerability exists in ApolloTheme AP Page Builder versions prior to 4.0.0, which stems from an unauthenticated remote user being able to modify the productitempath in the config JSON file, which could result in...
Horner Automation Cscape 缓冲区错误漏洞
Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation. A buffer error vulnerability exists in Horner Automation Cscape version 10.0 that originates from an out-of-bounds read and could allow an attacker to disclose information...
CVE-2024-11615
The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetradeleteLanguageFile' and 'zetradeleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes ...
CVE-2025-47626
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in apasionados Submission DOM tracking for Contact Form 7 allows Stored XSS. This issue affects Submission DOM tracking for Contact Form 7: from n/a through 2.0...
CVE-2025-46332 Information Disclosure via Flags override link
Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags...
CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce
Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...
CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce
Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...
CVE-2025-44193
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...