5869 matches found
PT-2025-10087
Name of the Vulnerable Software and Affected Versions StarSea99 starsea-mall version 1.0 Description A problematic vulnerability has been discovered, affecting an unknown part of the file /admin/carousels/save. The issue involves the manipulation of the redirectUrl argument, leading to cross-site...
CVE-2025-2085: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The manipulation of the argument redirectUrl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...
SUSE CVE-2022-49175
In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in devicepmcheckcallbacks The function devicepmcheckcallbacks can be called under the spin lock in the reported case it happens from genpdadddevice - devpmdomainset, when the genpd uses spinlocks rather...
SUSE CVE-2022-49219
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix memory leak during D3hot to D0 transition If 'vfiopcicoredevice::needspmrestore' is set PCI device does not have NoSoftReset bit set in its PMCSR config register, then the current PCI state will be saved locally in...
SUSE CVE-2022-49559
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal operation, the sanity check is...
PT-2025-9040
Name of the Vulnerable Software and Affected Versions Cardealer theme for WordPress versions up to, and including, 1.6.4 Description The issue is related to a missing capability check on the save settings function, which allows authenticated attackers with subscriber-level access and above to...
PT-2025-8910 · WordPress · Sakolawp
Name of the Vulnerable Software and Affected Versions: SakolaWP plugin for WordPress versions prior to 1.0.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save exam setting and delete exam setting actions. This allows...
CVE-2025-25818
A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...
DEBIAN-CVE-2022-49559
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal operation, the sanity check is...
DEBIAN-CVE-2022-49175
In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in devicepmcheckcallbacks The function devicepmcheckcallbacks can be called under the spin lock in the reported case it happens from genpdadddevice - devpmdomainset, when the genpd uses spinlocks rather...
emlog 安全漏洞
emlog is a PHP and MySQL based CMS website builder for emlog personal developers. A security vulnerability exists in emlog Pro version v2.5.4, which originates from the postStrVar function in articlesave.php and is vulnerable to cross-site scripting attacks...
PT-2025-8723
Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.4 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the postStrVar function at the "article save.php" endpoint. Recommendations For...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a memory leak caused by vfio/pci not freeing pmsave memory during the D3hot to D0 transition...
CVE-2025-25818
A cross-site scripting (XSS) vulnerability exists in Emlog Pro v2.5.4 , a PHP and MySQL-based CMS website builder. The flaw originates from the postStrVar function located in article_save.php , where an attacker can inject a crafted payload to execute arbitrary web scripts or HTML. While the secu...
CVE-2025-27142 LocalSend path traversal vulnerability in the file upload endpoint allows nearby devices to execute arbitrary commands
LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the POST /api/localsend/v2/prepare-upload and th...
CVE-2025-27142
LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the "POST /api/localsend/v2/prepare-upload" and...
PT-2025-7912 · Localsend · Localsend
Name of the Vulnerable Software and Affected Versions: LocalSend versions prior to 1.17.0 Description: The issue arises from the missing sanitization of the path in the "POST /api/localsend/v2/prepare-upload" and "POST /api/localsend/v2/upload" endpoints, allowing a malicious file transfer reques...
CVE-2025-27142: Improper Limitation of a Pathname to a Restricted Directory
LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the POST /api/localsend/v2/prepare-upload and th...
VulnCheck KEV: CVE-2023-34192
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function...
