ChurchCRM Code Execution Vulnerability

ChurchCRM is an open source church management system. ChurchCRM suffers from a code execution vulnerability that stems from user input in the installation wizard being written directly to a configuration file without validation, which can be exploited by an attacker to cause remote code execution...

CVE-2025-14418

pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must...

CVE-2019-25255 VideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with root privileges. Attackers can exploit the vulnerability through a cross-site request forgery CSRF mechanism to gain unauthorized system...

CVE-2024-57521

SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java...

EUVD-2025-204963

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this...

Linux Distros Unpatched Vulnerability : CVE-2025-14935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

iWT FaceSentry Access Control System 安全漏洞

The iWT FaceSentry Access Control System is an iWT open source application. It provides an access control function. A security vulnerability exists in iWT FaceSentry Access Control System version 6.4.8, which stems from an authenticated remote command injection in the pingTest.php and...

CVE-2025-66213

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions...

CVE-2025-13700 DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability

DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of DreamFactory. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

CVE-2025-14936 NSF Unidata NetCDF-C Attribute Name Stack-based Buffer Overflow Remote Code Execution Vulnerability

NSF Unidata NetCDF-C Attribute Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the targe...

CVE-2025-14922

CVE-2025-14922 describes a deserialization of untrusted data vulnerability in Hugging Face Diffusers CogView4. The flaw lies in parsing checkpoints where insufficient validation allows deserialization of untrusted data, enabling remote code execution in the target process. Exploitation requires u...

CVE-2025-14927 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

Hugging Face Transformers SEW-D convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the...

EUVD-2023-60248

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the...

CMSimple 代码注入漏洞

CMSimple is a free content management system. CMSimple suffers from a code execution vulnerability that stems from the template editing feature not securely controlling and filtering the content of user-inputted code, resulting in logged-in users being able to inject malicious PHP code into...

GIMP 安全漏洞

GIMP is an open source bitmap image editor from the GIMP team. A security vulnerability exists in GIMP that stems from a lack of proper validation of the length of user-supplied data when parsing an LBM file before copying it to the stack buffer, which could lead to a stack buffer overflow and...

PDFsam Enhanced 安全漏洞

PDFsam Enhanced is a PDF editing and management tool from PDFsam, Inc. A security vulnerability exists in PDFsam Enhanced that stems from processing DOC files in a way that allows execution of dangerous scripts without user warnings, which could lead to remote code execution...

Tencent HunyuanDiT 代码问题漏洞

Tencent HunyuanDiT is a diffusion model from Tencent China. A code issue vulnerability exists in Tencent HunyuanDiT that stems from a lack of validation of user-supplied data in the merge endpoint, which could lead to deserialization of untrusted data and remote code execution...

net-mgmt/net-snmp -- Remote Code Execution (snmptrapd)

net-snmp development team reports: A specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash...

CVE-2023-53971 WebTareas 2.4 Authenticated Remote Code Execution via File Upload

WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file pa...

MAL-2025-192689 Malicious code in unizip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 36d788bf5be2a646474da2cb929d2b24c328cd5bbd997697780a15da181d1053 During initialization of the archive-support class, the package download and executes remote malicious code --- Category: MALICIOUS - The campaign has clearly...