91257 matches found
CVE-2025-55316: External Control of File Name or Path
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...
CVE-2025-58977: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue affects WP eBay Product Feeds: from n/a through = 3.4.8...
CVE-2025-47694: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through = 3.4.7...
CVE-2025-32689: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through = 2.8.2...
CVE-2025-10198: Uncontrolled Search Path Element
Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories...
CVE-2025-52277: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field...
Photon OS 5.0: Libsoup PHSA-2025-5.0-0614
An update of the libsoup package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0614. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CVE-2025-54103: Use After Free
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally...
CVE-2025-10095: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically affecting the handling of certain parameters within the server's database interactions. The vulnerability is isolated to the SMPP server, which operates with its own dedicated...
CVE-2025-44594: Server-Side Request Forgery (SSRF)
halo v2.20.17 and before is vulnerable to server-side request forgery SSRF in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url...
CVE-2025-58215: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through 1.4.5...
CVE-2025-54894: Heap-based Buffer Overflow
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability...
CVE-2025-47695: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through = 3.4.7...
CVE-2025-47437: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through = 7.0.1...
CVE-2025-54236: Improper Input Validation
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high...
CVE-2025-54261: Improper Limitation of a Pathname to a Restricted Directory
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed...
CVE-2025-58982: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through = 1.3.8...
CVE-2025-7746: Improper Neutralization of Input During Web Page Generation
CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser...
