4744 matches found
Cockpit 代码注入漏洞
Cockpit is an interactive server management interface for Cockpit open source. A code injection vulnerability exists in Cockpit 2.11.3 and earlier versions, which stems from a cross-site scripting attack due to incorrect manipulation of the parameters name/email in the file /system/users/save...
Security Vulnerabilities fixed in Thunderbird 140 — Mozilla
A use-after-free in FontFaceSet resulted in a potentially exploitable crash. An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. Th...
SourceCodester Simple Company Website 代码问题漏洞
SourceCodester Simple Company Website is a simple company website from SourceCodester, Inc. A code issue vulnerability exists in version 1.0 of the SourceCodester Simple Company Website, which stems from a misbehavior of the parameter img in the file /classes/Users.php?f=save that results in...
CVE-2025-6826
A vulnerability, which was classified as critical, has been found in code-projects Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /PayrollManagementSystem/ajax.php?action=savedepartment. The manipulation of the argument ID leads to sql injection. T...
Code-Projects Payroll Management System 注入漏洞
Code-Projects Payroll Management System is an open source payroll management system from Code-Projects. Code-Projects Payroll Management System version 1.0 suffers from an injection vulnerability, which originates from SQL injection due to incorrect operation of the parameter ID in the file...
CVE-2025-6778
A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/savesettings.php. The manipulation of the argument sitephone/siteemail/address leads to cross site scripting. It is possible to launch the...
CVE-2025-6778
CVE-2025-6778 affects code-projects Food Distributor Site 1.0. The vulnerability is an XSS in an unknown function of /admin/save_settings.php, triggered by manipulating the arguments site_phone, site_email, or address. It can be exploited remotely, and multiple sources indicate the exploit has be...
Code-Projects Food Distributor Site 代码注入漏洞
Code-Projects Food Distributor Site is a Code-Projects open source food distributor site. A code injection vulnerability exists in Code-Projects Food Distributor Site version 1.0, which originates from cross-site scripting due to incorrect operation of the parameters sitephone/siteemail/address i...
SUSE CVE-2025-6435
If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and...
UBUNTU-CVE-2025-6435
If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and...
CVE-2025-6435
If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and...
Exploit for CVE-2025-49132
CVE-2025-49132poc Usage Examples 1. Scanning a single...
Arbitrary File Upload
Overview hipdevteam/bb-plugin is a Fork of BB Plugin Pro for use with composer Affected versions of this package are vulnerable to Arbitrary File Upload via the saveenabledicons function. An attacker can upload arbitrary files to the server by bypassing file type validation, which may allow...
CVE-2025-6220
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...
The vulnerability of the built-in boa server (/boafrm/formSaveConfig) of the TOTOLINK EX1200T router’s microprogramming software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the built-in boa server /boafrm/formSaveConfig of the TOTOLINK EX1200T router’s microprogramming software is related to the issue of the operation going beyond the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious acto...
CVE-2025-6129
A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232B20210713. This vulnerability affects unknown code of the file /boafrm/formSaveConfig of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can b...
Astra Linux – Vulnerability in Firefox
If a user saved a response from the Network tab in Devtools using the “Save As” context menu option, the file might not have been saved with the .download file extension. This could have allowed the user to run a malicious executable inadvertently. This vulnerability has been fixed in Firefox 140...
TOTOLINK EX1200T 安全漏洞
The TOTOLINK EX1200T is a wireless router from TOTOLINK that offers convenient network connectivity and management features. A buffer overflow vulnerability exists in the TOTOLINK EX1200T version 4.1.2cu.5232B20210713. The vulnerability arises due to a flaw in the handling of the submit-url...
Traffic Offense Reporting System save-settings.php file cross-site scripting vulnerability
Traffic Offense Reporting System is a traffic violation reporting system. Traffic Offense Reporting System suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied data by the sitename parameter in the save-settings.php file...
