18574 matches found
SOPlanning 安全漏洞
SOPlanning is a suite of online project management software from SOPlanning, Inc. A security vulnerability exists in SOPlanning versions prior to 1.55, which stems from a lack of permission checking in the /status endpoint that could lead to improper access control...
CVE-2024-8528 ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter
Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...
EUVD-2025-198083
The comment editing template dzz/comment/template/editform.htm in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and...
CVE-2025-56527
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...
A Simple WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers
By plugging tens of billions of phone numbers into WhatsApp’s contact discovery tool, researchers found “the most extensive exposure of phone numbers” ever—along with profile photos and more...
CVE-2025-13343
A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manipulation of the argument Question results in cross site scripting. It is possible to launch the attack remotely. The exploit has been...
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in...
WordPress Enable SVG, WebP, and ICO Upload plugin <= 1.1.2 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass vulnerability
Authenticated Author+ Arbitrary File Upload via ICO Upload Bypass vulnerability discovered by mikemyers in WordPress Plugin Enable SVG, WebP & ICO Upload versions = 1.1.2...
CVE-2025-13323
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public...
wiki.js 安全漏洞
wiki.js is an open source Wiki application from requarks.io. A security vulnerability exists in wiki.js version 2.5.307, which stems from the failure to properly revoke a JWT token when a user logs out, which could lead to unauthorized access...
Canva 安全漏洞
Canva is a design platform from Canva Australia. A security vulnerability exists in Canva versions prior to 1.117.1, which stems from an unenabled hardened runtime and could lead to a local attacker executing arbitrary code...
PT-2025-47231
Name of the Vulnerable Software and Affected Versions code-projects Simple Pizza Ordering System version 1.0 Description A security flaw exists in code-projects Simple Pizza Ordering System 1.0. Manipulation of the ID argument in the /listorder.php file results in SQL injection. The attack can be...
CVE-2025-56527
The CVE-2025-56527 entry concerns Kotaemon 0.11.0 where plaintext passwords are stored in the client’s localStorage. The associated CVSS 3.1 score is 7.5 (HIGH) with an attack vector of Network, attack complexity Low, no privileges required, no user interaction, and but with Confidentiality Impac...
Gallagher HBUS Devices 安全漏洞
Gallagher HBUS Devices is a family of access control and alarm peripheral devices from Gallagher New Zealand. A security vulnerability exists in Gallagher HBUS Devices that stems from improper use of seeds in the pseudo-random number generator, which could result in corrupting internal device...
EUVD-2025-198058
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a toke...
PT-2025-47377
Name of the Vulnerable Software and Affected Versions GNU GRUB Grand Unified Bootloader affected versions not specified Description A use-after-free issue exists in GNU GRUB Grand Unified Bootloader. The problem stems from an incorrect memory pointer retention during the file-closing process,...
CVE-2025-13208
A security flaw has been discovered in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. The impacted element is an unknown function of the file controller/api/hotelList.php. The manipulation of the argument subjectId/cityName results in sql injection. The attack can be...
EUVD-2025-197690
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections...
GitLab 安全漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE and EE versions 17.6 through befo...