AstrBot security vulnerabilities

AstrBot is an open-source multi-platform LLM chatbot and development framework created by AstrBot. Versions of AstrBot 4.16.0 and earlier contain security vulnerabilities. These vulnerabilities stem from a hard-coded credential issue in the Dashboard component’s file...

SourceCodester Pizzafy E-commerce System Injection Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

HyperChat code-related vulnerabilities

HyperChat is an open-source local AI agent platform developed by dadigua. It supports configuration-driven and project-level AI expertise. Versions of HyperChat 2.0.0-alpha.63 and earlier have code vulnerabilities. These vulnerabilities stem from the baseurl parameter in the fetch function of the...

O2OA security vulnerabilities

O2OA is an open-source enterprise application development platform developed by O2OA. Versions of o2oa 10.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from a function called syncFile in the NodeAgent component, which allowed improper authorization, potentially...

Processing-Claude MCP Bridge Path Traversal Vulnerability

Processing-Claude MCP Bridge is a bridge tool developed by Mariano, allowing for control of Processing applications via natural language. Processing-Claude MCP Bridge contains a path traversal vulnerability, which stems from the sketchname parameter in the processingserver.py file within the...

CloudBase MCP code-related vulnerabilities

CloudBase MCP is an open-source tool developed by Tencent CloudBase, serving as a bridge between AI programming tools and cloud deployment. Versions of CloudBase MCP 2.17.0 and earlier contain code vulnerabilities. These vulnerabilities stem from the openUrl function in the...

Claude Agent SDK Master path traversal vulnerability

Claude Agent SDK Master is a progressive learning tutorial for Claude Agent SDK developed by Erlich. Claude Agent SDK Master has a path traversal vulnerability; this vulnerability stems from the outputFile parameter in the app/api/agent-output/route.ts file, which allows for path traversal,...

TOTOLINK N300RT Buffer Error Vulnerability

TOTOLINK N300RT is a wireless router from TOTOLINK Corporation that complies with the 802.11n standard. The TOTOLINK N300RT version 3.4.0-B20250430 contains a buffer error vulnerability. This vulnerability stems from a buffer overflow in the iscmdstringvalid function of the libapmib.so component,...

Spire.Doc MCP Server path traversal vulnerability

Spire.Doc MCP Server is a tool provided by E-iceblue Product Family for individual developers, allowing them to work with Word documents without the need for Microsoft Word. Version 0.1.1 of Spire.Doc MCP Server contains a path traversal vulnerability. This vulnerability stems from the getpdfpath...

XXL-JOB code-related vulnerabilities

XXL-JOB is a distributed task scheduling platform developed by Xuxue Li xuxueli. Versions of XXL-JOB 3.3.2 and earlier have code vulnerabilities. These vulnerabilities stem from operations on the parameter addressList in the function triggerJob of the trigger Endpoint. This operation allows for...

D-Link DIR-825M buffer error vulnerability

The D-Link DIR-825M is a router produced by D-Link Corporation. Version 1.1.12 of the D-Link DIR-825M contains a buffer overflow vulnerability. This vulnerability arises from the parameter submit-url in the function sub414BA8 within the file /file/boafrm/formWanConfigSetup, which leads to a buffe...

TOTOLINK N300RT Buffer Error Vulnerability

The TOTOLINK N300RT is a wireless router from TOTOLINK Corporation that complies with the 802.11n standard. The version 3.4.0-B20250430 of the Totolink N300RT has a buffer error vulnerability. This vulnerability stems from a buffer overflow in the entryname parameter of the /boafrm/formIpQoS file...

Code-Projects Employee Management System Injection Vulnerability

Code-Projects Employee Management System is an open-source employee management system developed by Code-Projects. Version 1.0 of the Code-Projects Employee Management System has a SQL injection vulnerability. This vulnerability arises from unknown code in the 370project/delete.php file, which...

Tenda HG3 command injection vulnerability

The Tenda HG3 is a fiber-optic network terminal wireless router device designed for home broadband access by the Chinese company Tenda. Version 2.0 of the Tenda HG3 has a command injection vulnerability. This vulnerability arises from the operation of an unknown function in the...

Code-Projects Employee Management System Injection Vulnerability

Code-Projects Employee Management System is an open-source employee management system developed by Code-Projects. Version 1.0 of the Code-Projects Employee Management System has a SQL injection vulnerability. This vulnerability arises from the operation of an unknown function in the...

Hermes Agent authorization issue vulnerability

Hermes Agent is an AI agent tool developed by Nous Research, featuring a self-learning mechanism. Version 0.8.0 of Hermes Agent contains an authorization vulnerability. This vulnerability arises from an unknown function in the Webhooks Endpoint component’s gateway/platforms/webhook.py file, which...

Code-Projects Invoice System in Laravel: Access control error vulnerability

Code-Projects Invoice System in Laravel is an open-source invoice system developed by Code-Projects. Version 1.0 of the Code-Projects Invoice System in Laravel contained a access control vulnerability. This vulnerability was caused by an unknown function in the /company file, which allowed...

Hermes Agent authorization issue vulnerability

Hermes Agent is an AI agent tool developed by Nous Research, featuring a self-learning mechanism. Version 0.8.0 of Hermes Agent contains an authorization vulnerability. This vulnerability stems from the checkauth function in the APISERVERKEY Handler component’s gateway/platforms/apiserver.py file...

Code-Projects Chat System Encryption Vulnerabilities

Code-Projects Chat System is an open-source chat system developed by Code-Projects. Version 1.0 of the code-projects Chat System has a security vulnerability related to encryption. This vulnerability stems from the parameter “Password” in the MD5 Hash Handler component’s “updateuser.php” file,...

Security vulnerabilities in the Code-Projects Invoice System in Laravel

Code-Projects Invoice System in Laravel is an open-source invoice system developed by Code-Projects. Version 1.0 of the Code-Projects Invoice System in Laravel contained a security vulnerability. This vulnerability stemmed from improper handling of parameter IDs in the Invoice Endpoint component’...