DivvyDrive Web 安全漏洞

DivvyDrive Web is a file management and sharing system from the Turkish company DivvyDrive. A security vulnerability exists in DivvyDrive Web versions 4.8.2.2 through prior to 4.8.2.15, which stems from the presence of an observable timing difference that could lead to a cross-domain search timin...

The vulnerability of the CPython interpreter, related to reading beyond the allowed range, allows a violator to trigger a service failure.

The vulnerability of the CPython interpreter relates to reading beyond the acceptable range. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Flag Forge 信息泄露漏洞

Flag Forge is an easy-to-use CTF platform open-sourced by FlagForge. An information disclosure vulnerability exists in Flag Forge versions 2.1.0 through prior to 2.3.0, which stems from an API endpoint where GET /api/problems/:id returns a challenge prompt in plaintext, which could lead to...

CVE-2025-9342 IDOR in Anadolu Hayat Emeklilik's AHE Mobile

Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobile: from 1.9.7 before 1.9.9...

CVE-2025-10826 Campcodes Online Beauty Parlor Management System sales-reports-detail.php sql injection

A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launche...

0xtrails (>=0.1.9, <=0.2.2), @aarc-dev/deposit-widget (>=0.4.2, <=0.4.47) +4 more potentially affected by CVE-2025-59430 via @meshconnect/web-link-sdk (>=3.0.2, <=3.2.14)

@meshconnect/web-link-sdk NPM version =3.0.2, =0.1.9, =0.4.2, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.3 Source cves: CVE-2025-59430 Source advisory: SNYK:JS-MESHCONNECTWEBLINKSDK-13004671...

CVE-2025-59532 Codex has sandbox bypass due to bug in path configuration logic

Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. This log...

CVE-2025-58244

Cross-Site Request Forgery CSRF vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through = 4.3.9...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

CVE-2025-36064 affects IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0–3.1.0.22. The root cause is an inadequate account lockout setting that could permit a remote attacker to brute‑force credentials. IBM’s bulletin (and related sources) list a CVSS v3.1 base score of 5.9 (NEU...

Command Injection

Overview git-commiters is a Statistical summary of various infomation about git commiter. Affected versions of this package are vulnerable to Command Injection via the gitCommiters API which allows specifying options such as cwd for current working directory and revisionRange as a revision pointe...

GHSA-G38C-WXJF-XRH6 `git-comiters` Command Injection vulnerability

Background on the vulnerability This vulnerability manifests with the library's primary exported API: gitCommitersoptions, callback which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not saniti...

PT-2025-38788

Name of the Vulnerable Software and Affected Versions themewant Easy Hotel Booking versions through 1.6.9 Description An issue exists in themewant Easy Hotel Booking that allows for DOM-Based Cross-site Scripting XSS. This occurs due to improper neutralization of input during web page generation...

PT-2025-38786

Name of the Vulnerable Software and Affected Versions Meitar Subresource Integrity SRI Manager versions through 0.4.0 Description An authorization issue exists in Meitar Subresource Integrity SRI Manager, allowing exploitation due to incorrectly configured access control security levels...

PT-2026-2526

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The iomap adjust read range function incorrectly assumes that the position and length parameters are block-aligned. This can occur with the erofs filesystem. The incorrect calculation ca...

PT-2025-38820

Name of the Vulnerable Software and Affected Versions SALESmanago versions through 3.8.1 Description SALESmanago is susceptible to a Cross-Site Request Forgery CSRF issue. This allows an attacker to potentially perform actions on behalf of an authenticated user without their knowledge...

PT-2025-38961

Name of the Vulnerable Software and Affected Versions WP User Frontend versions through 4.1.11 Description An authorization issue exists in WP User Frontend, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update WP User Frontend to a version...

PT-2025-38997

Name of the Vulnerable Software and Affected Versions Binsaifullah Beaf versions through 1.6.2 Description A Server-Side Request Forgery SSRF issue exists in Binsaifullah Beaf. This allows for Server Side Request Forgery. The issue impacts the application's ability to properly validate server...

PT-2025-38847

Name of the Vulnerable Software and Affected Versions Trustpilot Trustpilot Reviews versions through 2.5.925 Description A missing authorization issue exists in Trustpilot Trustpilot Reviews, stemming from incorrectly configured access control security levels. This allows for unauthorized access...

PT-2025-38935

Name of the Vulnerable Software and Affected Versions chtombleson Mobi2Go versions through 1.0.0 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious scripts can be...