WordPress Plugin Borderless has a code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

Opigno Learning path CMS Drupal Module Code Execution

The vulnerability of the Opigno Learning path CMS system’s Drupal component is related to errors in data processing during syntax analysis of code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2024-47554, CVE-2024-45801)

Summary IBM Rational Developer for i contains Code Coverage functionality that is affected by the following two issues. CVE-2024-47554 is a denial of service attack in the Code Coverage PDF Exporter function. CVE-2024-45801 is a remote execution attack in the Code Coverage Reports function. This...

Advisory ROSA-SA-2025-2669

software: python3 3.8.13 WASP: ROSA-CHROME packageevrstring: python3-3.8.13 CVE-ID: CVE-2015-20107 BDU-ID: 2022-03962 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the mailcap module of the Python programming language interpreter is related to insufficient validation of arguments passed to a...

Advisory ROSA-SA-2025-2625

software: postgresql 12.17 WASP: ROSA-CHROME packageevrstring: postgresql-12.17-2 CVE-ID: CVE-2024-0985 BDU-ID: 2024-01121 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the REFRESH MATERIALIZED VIEW CONCURRENTLY function of the PostgreSQL database management system involves privilege management...

PT-2025-4746 · Unknown · Audemium Erp

Name of the Vulnerable Software and Affected Versions: Audemium ERP versions =0.9.0 Description: A reflected cross-site scripting XSS issue allows remote attackers to execute an arbitrary JavaScript payload in the web browser of a user. This is achieved by including a malicious payload into the...

vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator

Description The vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It use torch.load function and weightsonly parameter is default value False. There is a security warning on...

CVE-2024-48419

Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access t...

CVE-2024-57595

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

redis: Redis' Lua library commands may lead to remote code execution

A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution...

ASUS AiCloud Arbitrary Command Execution

The vulnerability of the ASUS AiCloud cloud platform lies in the lack of measures taken at the management level to clean data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Amazon Linux 2 : redis (ALASREDIS6-2025-011)

The version of redis installed on the remote host is prior to 6.2.14-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2025-011 advisory. Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script...

PT-2025-4591 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.18 through 4.0.0-beta.252 Description: A vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data an...

Important: redis6

Issue Overview: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional...

OS Command Injection

Ray is vulnerable to Os command Injection. The vulnerability is due to improper input sanitization in the cpuprofile URL parameter, allowing attackers to execute OS commands remotely on the system running the Ray dashboard without authentication...

Microsoft Word Office Suites Code Execution

The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise is related to the use of an untrusted pointer. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

PT-2025-1256

Name of the Vulnerable Software and Affected Versions SonicWall SMA 1000 Series versions prior to 12.4.3-02804 Description A pre-authentication deserialization of untrusted data vulnerability exists in the SMA1000 Appliance Management Console AMC and Central Management Console CMC. Deserializatio...

Active Directory Federation Server CSRF

The vulnerability of the Active Directory Federation Server operating system on Windows is related to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to execute a CSRF attack remotely...

QTS Network Device CRLF Injection

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

QTS Network Device CRLF Injection

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...