31405 matches found
CVE-2025-58578
The CVE-2025-58578 describes an API misuse where an authorized user can create an unlimited number of user accounts via a POST endpoint due to no quotas or validation. Public documents across Red Hat, NVD, CVE lists, and SICK-related advisories confirm the core issue (unbounded account creation) ...
Fedora: Security Advisory (FEDORA-2025-c12211d6bc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Google Chrome Security Update (stable-channel-update-for-desktop_30-2025-09) - Mac OS X
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
Debian: Security Advisory (DSA-6019-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EUVD-2025-32444
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be...
PT-2025-40792
Name of the Vulnerable Software and Affected Versions Frappe LMS version 2.35.0 Description A flaw exists in Frappe LMS that allows for improper access controls. The issue is related to an unknown function within the /courses/ file of the Unpublished Course Handler component. The attack can be...
PT-2025-40793
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be...
CVE-2025-8726
The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppauserupload function. This makes it possible for authenticated attackers, with Subscriber-level...
WordPress Backup Bolt plugin <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download vulnerability
Authenticated Admin+ Arbitrary File Download vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Backup Bolt versions = 1.4.1...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2024-0099
Malicious code in bioql PyPI...
EUVD-2024-48655
Malicious code in bioql PyPI...
EUVD-2021-33288
Malicious code in bioql PyPI...
EUVD-2023-1340
Malicious code in bioql PyPI...
EUVD-2023-55042
Malicious code in bioql PyPI...
EUVD-2025-22221
Malicious code in bioql PyPI...
EUVD-2024-21352
Malicious code in bioql PyPI...
EUVD-2024-28207
Malicious code in bioql PyPI...