CVE-2025-6776 xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversal

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-6776 xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversal

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-6775 xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injection

A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function createuser of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible ...

CVE-2025-6775 xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injection

A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function createuser of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible ...

CVE-2025-6774

The CVE-2025-6774 vulnerability affects the gooaclok819 sublinkX project (versions up to 1.8). The root cause is in AddTemp (api/template.go), where manipulating the filename parameter enables path traversal. This can potentially be exploited remotely, and public exploit information exists. A fix...

CVE-2025-6774 gooaclok819 sublinkX template.go AddTemp path traversal

A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp of the file api/template.go. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been...

GHSA-3Q2W-42MV-CPH4 filebrowser Allows Shell Commands to Spawn Other Commands

!NOTE This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We're publishing this new...

filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

Summary The Markdown preview function of File Browser v2.32.0 is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser Impact A user can upload a malicious Markdown file to the application which can...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Camel-core (CVE-2020-11971)

Summary Rebind Flaw vulnerability in Camel-core may affect IBM Spectrum Control. CVE-2020-11971. Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrad...

PT-2025-27211 · Unknown · Plumwd Twitch Tv Embed Suite

Name of the Vulnerable Software and Affected Versions: plumwd Twitch TV Embed Suite versions n/a through 2.1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the plumwd Twitch TV Embed Suite. Recommendations: For versions n/a through 2.1.0,...

PT-2025-27151 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 versions =V15.03.05.19 Description: A buffer overflow issue exists in the fromNatStaticSetting function via the page parameter. Recommendations: For Tenda AC6 versions =V15.03.05.19, update to a version later than V15.03.05.19 to...

PT-2025-27177 · WordPress · Blend Media Wordpress Cta

Name of the Vulnerable Software and Affected Versions: Blend Media WordPress CTA versions 1.6.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Blend Media WordPress CTA, allowing unauthorized requests. Recommendations: For Blend Media WordPress CTA versions 1.6.9 and...

PT-2025-27156 · Cyberchimps · Cyberchimps Responsive Blocks

Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Blocks versions n/a through 2.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2025-27121 · Unknown · Pebas Couponxxl Custom Post Types

Name of the Vulnerable Software and Affected Versions: pebas CouponXxL Custom Post Types versions 3.0 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in pebas CouponXxL Custom Post Types. Recommendations: For versio...

PT-2025-27192 · Unknown · Quick Favicon

Name of the Vulnerable Software and Affected Versions: Quick Favicon versions through 0.22.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables an attacker to inject malicious...

PT-2025-27221 · Unknown · Aioseo Multibyte Descriptions

Name of the Vulnerable Software and Affected Versions: Aioseo Multibyte Descriptions versions 0.0.0 through 0.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions...

PT-2025-27208 · Hidepost · Hidepost

Name of the Vulnerable Software and Affected Versions: HidePost versions prior to 2.3.8 Description: A Cross-Site Request Forgery CSRF issue in HidePost allows for Reflected XSS. This means an attacker could potentially trick a user into performing unintended actions on the web application...

PT-2025-27130 · WordPress · Davenport

Name of the Vulnerable Software and Affected Versions: Davenport - Versatile Blog and Magazine WordPress Theme versions 1.3 and earlier Description: The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability enables an attacker to access and include local...

PT-2025-27174 · Unknown · Hide Admin Bar From Front End

Name of the Vulnerable Software and Affected Versions: Hide Admin Bar From Front End versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where a...

PT-2025-27069 · WordPress · Fl3R Accessibility Suite

Name of the Vulnerable Software and Affected Versions: FL3R Accessibility Suite plugin for WordPress versions up to, and including, 1.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode due to insufficient input sanitization and...