CVE-2025-64192 WordPress XStore theme < 9.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through 9.6...

CVE-2025-68461

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting XSS vulnerability via the animate tag in an SVG document...

PT-2025-52159

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EverPress Mailster mailster allows Reflected XSS.This issue affects Mailster: from n/a through 4.1.14...

Mozilla Firefox < 3.0.15

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 3.0.15. It is, therefore, affected by a vulnerability as referenced in the mfsa2009-55 advisory. - Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute...

Mozilla Firefox < 32.0

The version of Firefox installed on the remote Windows host is prior to 32.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2014-69 advisory. - Apparent info leak caused by uninitialized memory with malformed GIFsCVE-2014-1564 CVE-2014-1564 Note that Nessus has not tested...

Mozilla Firefox < 3.0.6

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 3.0.6. It is, therefore, affected by a vulnerability as referenced in the mfsa2009-02 advisory. - Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass...

CVE-2025-64400: Improper Access Control

Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has edit on the enrollment-level user directory, but is missing a separate check that the enrollment...

Utarit SoliClub 安全漏洞

Utarit SoliClub is a mobile application from Utarit, Inc. A security vulnerability exists in Utarit SoliClub versions prior to 5.3.7, which stems from a lack of authorization checking and could lead to privilege abuse...

Mozilla Firefox < 1.0.8

The version of Firefox installed on the remote Windows host is prior to 1.0.8. It is, therefore, affected by a vulnerability as referenced in the mfsa2006-18 advisory. - https://bugzilla.mozilla.org/showbug.cgi?id=269095CVE-2006-0749 CVE-2006-0749 Note that Nessus has not tested for this issue bu...

PT-2025-52184

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.6...

PT-2025-52292

Name of the Vulnerable Software and Affected Versions Control Panel affected versions not specified Description The Control Panel software has an issue with its API for pre-registering users into an enrollment and organization before their initial login. The API used for user creation verifies th...

Mozilla Firefox < 8.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 8.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2011-51 advisory. - Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the GPU memory behavior...

CVE-2025-68432

Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol LSP configurations from the settings.json file located within a project’s .zed subdirectory. A malicious LSP configuration can contain arbitrary shell...

CVE-2025-68433 Zed IDE MCP Context Server Configuration Arbitrary Code Execution

Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol MCP configurations from the settings.json file located within a project’s .zed subdirectory. A malicious MCP configuration can contain arbitrary shell...

CVE-2025-68433 Zed IDE MCP Context Server Configuration Arbitrary Code Execution

Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol MCP configurations from the settings.json file located within a project’s .zed subdirectory. A malicious MCP configuration can contain arbitrary shell...

CVE-2025-68433

CVE-2025-68433 affects Zed IDE prior to 0.218.2-pre. The vulnerability arises from loading MCP configurations from a project/.zed/settings.json without explicit user confirmation, allowing a malicious MCP to execute arbitrary shell commands on the host with the IDE user’s privileges when a projec...

CVE-2025-68432

Summary: CVE-2025-68432 affects Zed IDE and enables arbitrary code execution by loading LSP configurations from a project’s .zed/settings.json. A malicious LSP entry could execute shell commands with the user’s privileges when a project file with an LSP entry is opened. Affected versions: prior t...

EUVD-2025-204014

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery CSRF vulnerability exists in the application's filter configuration. The CSRF protection...

CVE-2025-68110

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue...

CVE-2025-68401

CVE-2025-68401 affects ChurchCRM prior to version 6.0.0, where user-supplied HTML/JS is stored without sufficient sanitization/encoding. Stored XSS can occur when other users view the content, potentially enabling attacker-controlled JavaScript to access web-origin data and perform privileged act...