CVE-2025-57756

Contao CMS vulnerability CVE-2025-57756: Protected content elements rendered as fragments are indexed by the front-end search, exposing content publicly. Affected versions range from 4.9.14 up to before 4.13.56, 5.3.38, and 5.6.1. The issue is fixed in 4.13.56, 5.3.38, and 5.6.1. Workaround: disa...

GHSA-W53M-GXVG-VX7P Contao can disclose sensitive information in the news module

Impact If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. Patches Update to Contao 5.3.38 or 5.6.1. Workarounds Do not add protected news archives to the news feed page. For more information If you have any questions o...

Contao can disclose sensitive information in the news module

Impact If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. Patches Update to Contao 5.3.38 or 5.6.1. Workarounds Do not add protected news archives to the news feed page. For more information If you have any questions o...

CVE-2025-7956

The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of a...

CVE-2025-7956

The CVE-2025-7956 entry concerns Ajax Search Lite for WordPress. It exposes Basic Information through a missing authorization check in ASL_Query within the AJAX search handler, affecting versions up to 4.13.1 (some sources reference 4.13.2 as the fix). The vulnerability allows unauthenticated att...

PT-2025-34968

Name of the Vulnerable Software and Affected Versions: Ajax Search Lite versions prior to 4.13.2 Description: The Ajax Search Lite plugin for WordPress is susceptible to Basic Information Exposure. A missing authorization check in the AJAX search handler allows unauthenticated attackers to...

PT-2025-35102

Name of the Vulnerable Software and Affected Versions: Contao versions prior to 4.13.56 Contao versions prior to 5.3.38 Contao versions prior to 5.6.1 Contao versions starting from 4.9.14 through 5.6.1 Description: Protected content elements rendered as fragments are indexed and become publicly...

PT-2025-35103

Name of the Vulnerable Software and Affected Versions: Contao versions prior to 5.3.38 Contao versions prior to 5.6.1 Description: Contao is an Open Source CMS. News items from protected news archives within a news feed are not filtered and become publicly available in the RSS feed. A workaround...

Contao security vulnerabilities

Contao is an open source Content Management System CMS developed in PHP by Contao Open Source. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 4.13.56 and versions prior to 5.6.1, which stems from protected content...

CVE-2025-57757: Exposure of Sensitive Information to an Unauthorized Actor

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround...

Contao security vulnerabilities

Contao is an open source Content Management System CMS developed in PHP by Contao Open Source. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 5.3.38 and versions prior to 5.6.1, which stems from an unfiltered protected...

DRUPAL-CONTRIB-2025-101

This module enables you to protect individual pages with a password. The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks. This vulnerability is mitigated by the fact that an attacker must know the protected page's URL. CVSS risk score experimental...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

Exploit for CVE-2024-28397

CodeTwoRCEExploit This script incorporates authentication to a...

Huawei EchoLife EG8141A5 Unauthorized Access

The vulnerability of Huawei EchoLife EG8141A5, EG8145V5, and EG8145V5-V2 microprogrammed router software is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

NVIDIA NVDebug Disclosure Information

The vulnerability of the NVIDIA NVDebug debugging and diagnostic software lies in the deficiencies of its mechanism for assigning internal resources with debugging access levels. Exploiting this vulnerability can allow a remote attacker to disclose protected information...

Adaptive Substance 3D Painter Buffer Overflow

The vulnerability of the 3D model texturing software Adobe Substance 3D Painter lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

Adaptive Substance 3D Painter Buffer Overflow

The vulnerability of the 3D model texturing software Adobe Substance 3D Painter lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

Substance 3D Sampler Buffer Overflow

The vulnerability of the Substance 3D Sampler software for creating textures and materials for 3D models involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to disclose protected information...