AVideo 安全漏洞

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. A security vulnerability exists in AVideo versions 14.3.1 through prior to 20.1, which stems from the use of PHP uniqid to generate predictable installation salt values that could lead to remote code...

CVE-2025-65037

Improper control of generation of code 'code injection' in Azure Container Apps allows an unauthorized attacker to execute code over a network...

CVE-2023-53942 File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with ...

PT-2025-52321

Name of the Vulnerable Software and Affected Versions File Thingie version 2.5.7 Description The software contains an authenticated file upload issue that enables remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip i...

(0Day) Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint. The specific flaw exists within the convertconfig functio...

PT-2025-52384

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers affected versions not specified Description A flaw exists in the convert config function that allows remote attackers to execute arbitrary code on affected systems. Exploitation requires user interaction, specifically...

Mozilla Thunderbird < 1.5.0.4

The version of Thunderbird installed on the remote Windows host is prior to 1.5.0.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2006-31 advisory. - EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to gain privileges via javascript...

CVE-2023-53933 Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server...

Security Bulletin: IBM Rhapsody Systems Engineering is using next-15.4.7.tgz which is vulnerable to CVE-2025-55182

Summary A security vulnerability was identified in the Next.js package used in IBM Rhapsody Systems Engineering. The issue is resolved by updating to a non-vulnerable patched version to ensure the continued security and reliability of the product. Vulnerability Details CVEID:CVE-2025-55182...

CVE-2025-62847

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS...

📄 ICTBroadcast 7.0 Remote Code Execution

A vulnerability in ICTBroadcast version 7.0 allows unauthenticated remote command execution due to improper handling of session cookie values. An attacker can modify cookie entries to inject system commands that the application unintentionally executes...

CVE-2025-67172

RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the parsespecialtags function...

The vulnerability of the GET Parameter Handler component of the JoomlaUX JUX Real Estate plugin for the Joomla content management system allows a hacker to execute arbitrary SQL code.

The vulnerability of the GET Parameter Handler component in the JoomlaUX JUX Real Estate plugin for the Joomla content management system is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code remotely...

The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform allows a perpetrator to execute arbitrary JavaScript code.

The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the failure to protect the structure of the web page when processing the dataset.command parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScri...

CVE-2025-65233

Reflected cross-site scripting (XSS) is present in SLiMS (slims9_bulian) versions prior to 9.6.0 . The vulnerability is caused by the improper handling of the $_SERVER['PHP_SELF'] variable within the index.php/sysconfig.inc.php file. This flaw allows a remote attacker to execute arbitrary JavaScr...

CVE-2023-53885

Webutler v3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload PHP files with system command execution. Attackers can upload a PHAR file with embedded system commands to the media browser and execute arbitrary commands by accessing the uploaded fil...

CVE-2025-62847

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-62849 QTS, QuTS hero

An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and...

The vulnerability of the XWiki platform, which relates to the failure to implement measures to neutralize instructions in dynamically executed code, allows attackers to execute arbitrary code and gain access to read and modify data.

The vulnerability of the XWiki Platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and gain access to read and modify data...

CVE-2023-53871

Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server...