CVE-2025-59398

The OCPP implementation in libocpp before 0.26.2 allows a denial of service EVerest crash via JSON input larger than 255 characters, because a CiString object is created with StringTooLarge set to Throw...

CVE-2025-56252

Cross Site Scripting xss vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from a hard-coded use of the HTTP protocol instead of HTTPS when downloading small files in the scheduler...

i-Educar 访问控制错误漏洞

i-Educar is a free educational software from Portábilis Open Source. An access control error vulnerability exists in i-Educar version 2.10 and earlier, which stems from improper access control of unknown functions in the file /enrollment-history/, which could lead to a remote attack...

WordPress plugin WP Import – Ultimate CSV XML Importer for WordPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

i-Educar 安全漏洞

i-Educar is a free educational software from Portábilis Open Source. A security vulnerability exists in i-Educar version 2.10 and earlier, which stems from the incorrect manipulation of the parameter tipoacao in the file /agendapreferencias.php, which could lead to a cross-site scripting attack...

Linux Distros Unpatched Vulnerability : CVE-2025-58174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile...

PT-2025-38249

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue involves improper access controls due to manipulation of an unknown function within the /enrollment-history/ file...

CVE-2025-58174 LAM profile editor stored cross-site scripting vulnerability

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script for example a script element. An...

CVE-2025-58749

WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first operand memory address...

CVE-2025-0164

IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment...

CVE-2025-55115

A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions. This vulnerability wa...

CVE-2025-55118

CVE-2025-55118 concerns BMC Control-M/Agent. The issue is a memory corruption vulnerability that can be remotely triggered when SSL/TLS is configured, with specific non-default conditions: Control-M/Agent 9.0.20 using non-default SSL/TLS setting use_openssl=n; and 9.0.21/9.0.22 with non-default s...

CVE-2025-55116

The CVE-2025-55116 issue affects BMC Control-M/Agent, specifically versions 9.0.18–9.0.20 (potentially earlier unsupported builds). It is caused by a stack/buffer overflow in the Agent running on the target system, enabling local privilege escalation when an attacker has system access. Mitigation...

CVE-2025-8446 Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blazedemoimporterinstallplugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with...

Exploit for CVE-2025-27210

This is a PoC exploit for CVE-2025-27210, a vulnerability in a N...

CVE-2025-59436

The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415...

node-ip 代码问题漏洞

node-ip is a node.js module by indutny individual developer. A code issue vulnerability exists in node-ip version 2.0.1 and earlier, which stems from IP address 017700000001 being misclassified as globally routable, which could lead to server-side request forgery...

TDuckCloud tduck-platform 安全漏洞

TDuckCloud tduck-platform is an open source form survey system from China's Zongda Numerical Wei TDuckCloud company. A security vulnerability exists in TDuckCloud tduck-platform version 5.1, which stems from a SQL injection vulnerability in the file upload module that could lead to the execution ...

LDAP Account Manager 跨站脚本漏洞

LDAP Account Manager LAM is a web front-end to the LDAP Account Manager open source for managing entries e.g., users, groups, DHCP settings stored in the LDAP directory. A cross-site scripting vulnerability exists in LDAP Account Manager LAM versions prior to 9.3, which stems from a profile name...