12954 matches found
PT-2025-26548 · Unknown · Code-Projects Online Bidding System
Name of the Vulnerable Software and Affected Versions: code-projects Online Bidding System version 1.0 Description: A critical vulnerability has been found in the code-projects Online Bidding System. The issue is related to an unknown function of the file /bidlog.php, where the manipulation of th...
PT-2025-26530 · Yealink · Yealink Ymcs Rps
Name of the Vulnerable Software and Affected Versions: Yealink YMCS RPS versions prior to 2025-05-26 Description: The certificate upload function in Yealink YMCS RPS does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. Recommendations: For...
Buy It Now, Track Me Later: Attacking User Privacy Via Wi-Fi AP Online Auctions
Static and hard-coded layer-two network identifiers are well known to present security vulnerabilities and endanger user privacy. In this work, we introduce a new privacy attack against Wi-Fi access points listed on secondhand marketplaces. Specifically, we demonstrate the ability to remotely...
CVE-2025-3228
CVE-2025-3228 affects Mattermost server versions listed (e.g., 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x
PT-2025-26293 · Unknown · Phpgurukul Pre-School Enrollment System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System version 1.0 Description: A critical issue was found in the PHPGurukul Pre-School Enrollment System, affecting some unknown functionality of the file /visit.php. The manipulation of the gname argument...
PT-2025-26298 · Postbox · Postbox
Name of the Vulnerable Software and Affected Versions: Postbox versions affected versions not specified Description: The Postbox's configuration on macOS allows for Dynamic Library Dylib injection due to the presence of certain entitlements. A local attacker with unprivileged access can use...
USN-7584-1: Roundcube vulnerability
It was discovered that Roundcube Webmail did not properly sanitize the from parameter in a URL, leading to PHP Object Deserialization. A remote attacker could possibly use this issue to execute arbitrary code...
CVE-2025-4965 WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
PT-2025-26240 · Upsonic · Upsonic
Name of the Vulnerable Software and Affected Versions: Upsonic versions up to 0.55.6 Description: A critical vulnerability was found in Upsonic, affecting the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit...
MAL-2025-5354 Malicious code in @wh-components/icons (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dfd313ae1d8791cc49f1a8210019c206b2f892b8709b6d0e93f78f06653caf1 Any computer that has this package installed or running should be considered...
CVE-2025-6220
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...
MAL-2025-5091 Malicious code in widgets-networkupdatetool (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-5147 Malicious code in xxxxxxxx (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-5145 Malicious code in jdbc-zzz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in solana-charts (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in colorizator (PyPI)
--- -= Per source details. Do not edit below this line.=-...
CVE-2025-1562
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...
MAL-2025-5416 Malicious code in houdini_test_pack_1 (npm)
The package communicates with a domain associated with malicious activity...
Qualys TRU Uncovers Chained LPE: SUSE 15 PAM to Full Root via libblockdev/udisks
The Qualys Threat Research Unit TRU has discovered two linked local privilege escalation LPE flaws. The first CVE-2025-6018 resides in the PAM configuration of openSUSE Leap 15 and SUSE Linux Enterprise 15. Using this vulnerability, an unprivileged local attacker—for example, via SSH—can elevate ...
