CVE-2025-5129

CVE-2025-5129 pertains to Sangfor aTrust 2.3.10.60 where an uncontrolled search path is caused by a flaw in MSASN1.dll. The vulnerability can be exploited with local access and has high attack complexity; some references indicate that privileges may be required (local and elevated depending on so...

CVE-2025-2272

Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05...

PT-2025-22844 · Unknown +1 · Msasn1.Dll +1

Name of the Vulnerable Software and Affected Versions: Sangfor aTrust version 2.3.10.60 Description: A critical vulnerability has been found in Sangfor aTrust, affecting an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Local access is require...

PT-2025-22848 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall Demo up to 20250505 Description: A vulnerability has been found in the Search Box component of Tmall Demo, allowing for cross-site scripting through remote attack. The manipulation of an unknown function leads to this issue. The vendor...

Tmall_demo 代码注入漏洞

Tmalldemo is a Spring Boot-based mini Tmall by the Xianqi Mall projectteam team. A code injection vulnerability exists in Tmalldemo 20250505 and earlier versions, which stems from a misbehavior of the component Search Box resulting in cross-site scripting...

Sangfor aTrust 代码问题漏洞

Sangfor aTrust is a zero-trust access control system from China's Sangfor. A code issue vulnerability exists in Sangfor aTrust version 2.3.10.60, which stems from an uncontrolled search path in the MSASN1.dll library...

CVE-2025-23926

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TC.K Ajax WP Query Search Filter ajax-wp-query-search-filter allows Stored XSS.This issue affects Ajax WP Query Search Filter: from n/a through = 1.0.7...

CVE-2025-24572

Cross-Site Request Forgery CSRF vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through = 1.78.258...

CVE-2025-0732

A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of...

CVE-2025-24831

Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 39378...

CVE-2025-0733

A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The...

CVE-2025-24571

Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through = 1.78.258...

CVE-2025-0567

A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attacking locally is a requirement. The complexity of an attack ...

CVE-2025-0459

A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be...

CVE-2024-10021

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /php/managepurchase.php?action=search=VOUCHERNUMBER. The manipulation of the argument text leads to sql injection. The attack...

CVE-2024-47766

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

CVE-2024-7846

YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts...

CVE-2024-42697

Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function...

CVE-2024-8364

The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, and including, 1.2.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-7084

The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks...