718 matches found
CVE-2009-20010 Dogfood CRM spell.php RCE
Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate...
PT-2025-35366
Name of the Vulnerable Software and Affected Versions: Dogfood CRM version 2.0.10 Description: Dogfood CRM version 2.0.10 contains a remote command execution issue in the spell.php script used by its mail subsystem. The flaw is due to unsanitized user input passed via a POST request to the data...
PT-2025-34873
Name of the Vulnerable Software and Affected Versions: OPNsense version 25.1 Description: OPNsense version 25.1 contains an authenticated command injection issue in the Bridge Interface Edit endpoint interfaces bridge edit.php. The span POST parameter is concatenated into a system-level command...
Linux Distros Unpatched Vulnerability : CVE-2016-2145
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The amreadpostdata function in modauthmellon before 0.11.1 does not check if the apgetclientblock function returns an error, which allows remote attackers to...
CVE-2025-7839 Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery
The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rpdpodpaajaxdpdeletedata function. This makes it possible for unauthenticated...
CVE-2025-7839
CVE-2025-7839 affects the WordPress plugin “Restore Permanently delete Post or Page Data” (versions up to 1.0). The root cause is missing or incorrect nonce validation in the rp_dpo_dpa_ajax_dp_delete_data() function, enabling CSRF. This allows unauthenticated attackers to delete site data by tri...
WordPress plugin Restore Permanently delete Post or Page Data 跨站请求伪造漏洞
WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in WordPress plugin Restore...
VulnCheck KEV: CVE-2023-5815
The News & Blog Designer Pack – WordPress Blog Plugin — Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdpgetmorepost...
MAL-2025-29531 Malicious code in post-data (npm)
The package post-data was found to contain malicious code...
circle (>=0.0.0 <=0.0.9), democirclepackage (=1.0.3) +3 more potentially affected by unknown CVE via post-data (=0.0.0)
post-data NPM version =0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on post-data and may be impacted: - circle =0.0.0, =0.0.40, =0.0.0, =0.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-29531...
Malicious code in post-data (npm)
The package post-data was found to contain malicious code...
WordPress HT Mega - Absolute Addons For Elementor plugin Information Disclosure Vulnerability
WordPress HT Mega - Absolute Addons For Elementor plugin is an Elementor page builder plugin designed specifically for WordPress, offering over 100 custom widgets, 360+ preset modules, and multiple templates for blogs, sliders , collapsible menus and other page elements. A vulnerability exists in...
WordPress plugin HT Mega – Absolute Addons For Elementor 授权问题漏洞
WordPress HT Mega - Absolute Addons For Elementor plugin is an Elementor page builder plugin designed specifically for WordPress, offering over 100 custom widgets, 360+ preset modules, and multiple templates for blogs, sliders , collapsible menus and other page elements. A vulnerability exists in...
VulnCheck KEV: CVE-2025-47204
An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...
FreeScout 跨站脚本漏洞
FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a security bypass vulnerability that is caused by improper validation of user-supplied input in the session POST dataset. No detailed vulnerability...
CVE-2024-5654
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'executepostdatacg7free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site...
CVE-2022-28556
Tenda AC15 USAC15V1.0BRV15.03.05.20multiTDE01.bin is vulnerable to Buffer Overflow. The stack overflow vulnerability lies in the /goform/setpptpservercfg interface of the web. The sent post data startip and endip are copied to the stack using the sanf function, resulting in stack overflow...
CVE-2022-1267
The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2021-24384
The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...