📄 Flowise 3.0.4 Code Injection

Flowise versions 3.0.4 and below suffer from a remote command injection vulnerability. ============================================================================================================================================= | Title : Flowise 3.0.4 php code injection | | Author : indoushka | ...

📄 vBulletin 6.0.3 replaceAdTemplate Expression Injection

Proof of concept exploit for vBulletin versions 5.0.0 through 6.0.3 for the replaceAdTemplate expression injection vulnerability. ============================================================================================================================================= | Title : vBulletin 5.0.0...

EUVD-2020-4145

Malware in sbrugna...

EUVD-2008-6508

Malware in sbrugna...

EUVD-2025-12263

Malicious code in bioql PyPI...

WordPress plugin JoomSport 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-10267

CVE-2025-10267 affects the NUP Portal by NewType Infortech. The issue is missing authentication, allowing unauthenticated remote attackers to upload files. If file extension restrictions are bypassed, attackers could upload a webshell and execute it on the server side. Modeled across multiple fee...

PT-2025-34072

Name of the Vulnerable Software and Affected Versions: XWiki versions through 17.3.0 Description: XWiki is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticat...

CVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...

CVE-2012-10056

CVE-2012-10056 affects PHP Volunteer Management System v1.0.2. An arbitrary file upload vulnerability in the document upload feature allows authenticated users to upload files to mods/documents/uploads/ without file-type checks; the directory is publicly accessible and execution controls are miss...

CVE-2025-43948

Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier such as for sorting, which will get executed on the server side...

CVE-2025-43948

Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier such as for sorting, which will get executed on the server side...

CVE-2025-43948

CVE-2025-43948 affects Codemers KLIMS 1.6.DEV, where an input value for parameters/qualifiers can carry Python code that is executed on the server side, enabling remote code execution. Documents confirm the issue is due to Python code injection in KLIMS 1.6.DEV and describe potential server-side ...

CVE-2025-43948

Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier such as for sorting, which will get executed on the server side...

CVE-2025-43948

Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier such as for sorting, which will get executed on the server side...

WordPress plugin Advanced File Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-26520 · WordPress · Penci Soledad Data Migrator

Name of the Vulnerable Software and Affected Versions: Penci Soledad Data Migrator plugin for WordPress versions up to, and including, 1.3.0 Description: The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion via the data parameter. This allows unauthenticated...

CVE-2023-1716

Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...

PT-2023-31908 · WordPress · Openhook

Name of the Vulnerable Software and Affected Versions: OpenHook plugin for WordPress versions up to, and including, 4.3.0 Description: The issue allows authenticated attackers with subscriber-level permissions or above to execute code on the server via the php shortcode. This requires the php...

XWiki Platform 注入漏洞

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from XWiki France. An injection vulnerability exists in XWiki Platform, which arises from the ability of a user without scripting or programming privileges to edit a user profile or any other document and add...