CVE-2024-51541

Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

CVE-2024-37001

A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-13545

The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This...

PT-2025-4182 · Unknown · Blockchain Keystore

Name of the Vulnerable Software and Affected Versions: Blockchain Keystore versions prior to 1.3.16.5 Description: The issue is related to an out-of-bounds write in the Blockchain Keystore, which allows local privileged attackers to write out-of-bounds memory. This can potentially lead to...

CVE-2025-24958 SQL Injection endpoint 'salvar_tag.php' parameter 'id_tag' in WeGIA

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, salvartag.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This...

WeGIA SQL注入漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A SQL injection vulnerability exists in WeGIA 3.2.11 and prior versions that originates from allowing an authorized attacker to execute arbitrary SQL queries that could allow access to or delete sensitive...

PT-2025-3923 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX plugin versions up to 4.2.14 Description: The issue allows unauthenticated attackers to include PHP files on the server via the tabname parameter, enabling the execution of any PHP code in those files. This can be used to bypass...

Advisory ROSA-SA-2025-2634

Software: OpenImageIO 2.2.20.0 OS: ROSA-CHROME packageevrstring: OpenImageIO-2.2.20.0-6 CVE-ID: CVE-2023-36183 BDU-ID: 2023-07656 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the readimg function of the OpenImageIO image processing library involves buffer copying without input validation...

CVE-2024-48310

The CVE-2024-48310 entry concerns AutoLib Software Systems OPAC v20.10, where multiple API keys are exposed in the source code (e.g., main.js) allowing potentially unauthorized access to the backend API or other sensitive information. Affected component: API keys embedded in the codebase; exploit...

CVE-2025-24101

This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data...

CVE-2024-54549

This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data...

CVE-2025-24109

CVE-2025-24109 relates to a downgrade issue that was addressed by adding code-signing restrictions. The NVD entry states the issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, and macOS Sonoma 14.7.3, with the impact described as an app potentially accessing sensitive user data. Affected...

Apple macOS 竞争条件问题漏洞

Apple macOS is a suite of specialized operating systems developed by Apple Inc. for Mac computers. A competitive condition issue vulnerability exists in Apple macOS version 15.3, which arises from an application that may be able to access sensitive user data...

CVE-2024-56950

CVE-2024-56950 affects KuGou Concept for iOS (version 4.0.61). The issue allows attackers to access sensitive user information by sending a crafted link. Public details describe the vulnerability mechanism as a crafted link but do not include explicit exploit code or practical exploit steps. Some...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple, Inc. A security vulnerability exists in Apple macOS version 15.2, which stems from an application that may be able to access sensitive user data...

PT-2025-3369 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home iOS version 6.5.01 Description: The issue allows attackers to access sensitive user information via supplying a crafted payload. Recommendations: For Govee Home iOS version 6.5.01, at the moment, there is no information about a new...

CVE-2024-11090

CVE-2024-11090 affects the WordPress plugin “Membership Plugin – Restrict Content” (WordPress). Exposed versions: all up to and including 3.2.13. Root cause: the WordPress core search feature does not properly restrict access, allowing unauthenticated users to read restricted content. Impact: sen...

Fedora Repository fedoraIntCallUser default credentials and insecure archive extraction

RISK EVALUATION Fedora Repository 3.8 includes default user credentials and allows path traversal when extracting uploaded archive files. An attacker can exploit these vulnerabilities to read sensitive data and execute arbitrary commands with the privileges of the Java web application server...

CVE-2025-0428

The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form'postcontent' variable through the wpaicgexportprompts function. This allows authenticated attackers, with...

CVE-2025-21511

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...