5025 matches found
ASB-A-370477460
In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
CVE-2025-48331 WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Orders & Customers Exporter: from n/a through = 5.0...
CVE-2025-48331
CVE-2025-48331 concerns the WooCommerce Orders & Customers Exporter plugin (versions n/a–5.0). The issue is described as an information exposure caused by insertion of sensitive data into the sent data, which can allow retrieval of embedded sensitive data (the affected component is the exporter’s...
CVE-2025-48381
Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality...
Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems
Retrieval-Augmented Generation RAG systems, which integrate Large Language Models LLMs with external knowledge sources, are vulnerable to a range of adversarial attack vectors. This paper examines the importance of RAG systems through recent industry adoption trends and identifies the prominent...
PT-2025-23296 · Unknown · Vanquish Woocommerce Orders & Customers Exporter
Name of the Vulnerable Software and Affected Versions: Vanquish WooCommerce Orders & Customers Exporter versions n/a through 5.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions n/a...
When GPT Spills the Tea: Comprehensive Assessment of Knowledge File Leakage in GPTs
Knowledge files have been widely used in large language model LLM agents, such as GPTs, to improve response quality. However, concerns about the potential leakage of knowledge files have grown significantly. Existing studies demonstrate that adversarial prompts can induce GPTs to leak knowledge...
PT-2025-23251 · WordPress · Ninja Forms +4
Name of the Vulnerable Software and Affected Versions: The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress versions up to, and including, 1.4.4 Description: The issue allows unauthenticated attackers to retrieve the full path of the...
FreeFloat FTP Server 安全漏洞
FreeFloat FTP Server is an FTP service from FreeFloat. A buffer overflow vulnerability exists in FreeFloat FTP Server that stems from the failure of the RETR Command Handler component to properly validate the length size of input data, no details of the vulnerability are provided at this time...
CVE-2025-40650
Insecure Direct Object Reference IDOR vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards...
Spa-VLM: Stealthy Poisoning Attacks on RAG-Based VLM
With the rapid development of the Vision-Language Model VLM, significant progress has been made in Visual Question Answering VQA tasks. However, existing VLM often generate inaccurate answers due to a lack of up-to-date knowledge. To address this issue, recent research has introduced...
Exploit for CVE-2024-8682
CVE-2024-8682 - JNews Unauthenticated Registration PoC JNew...
CVE-2025-39498
Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds Premium allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds Premium: from n/a through 1.7.1...
CVE-2025-39498
CVE-2025-39498 concerns WordPress plugin Spotlight Social Feeds (Premium)
CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
Retrieval-Augmented Generation RAG enhances large language models LLMs by incorporating external knowledge, but its openness introduces vulnerabilities that can be exploited by poisoning attacks. Existing poisoning methods for RAG systems have limitations, such as poor generalization and lack of...
CVE-2025-47541
Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through = 1.17.7...
CVE-2025-47149
The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation. If exploited, the product may treat an unauthorized pattern file as an authorized. If the product uses a specially crafted pattern file, information in the server where the product is...
Benchmarking Poisoning Attacks against Retrieval-Augmented Generation
Retrieval-Augmented Generation RAG has proven effective in mitigating hallucinations in large language models by incorporating external knowledge during inference. However, this integration introduces new security vulnerabilities, particularly to poisoning attacks. Although prior work has explore...
CVE-2025-48741
A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and unprivileged users to retrieve alerts, cases, logs, observables, or tasks, regardless of the user's permissions, through a specific API...