CVE-2024-58260 Rancher update on users can deny the service to the admin

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts...

CVE-2025-8118

PAD CMS implements weak client-side brute-force protection by utilizing two cookies: logincount and logintimeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue...

CVE-2025-59524

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation for example, with an intercepting proxy or by...

CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation for example, with an intercepting proxy or by...

CVE-2025-8942

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

CVE-2025-8942

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

CVE-2025-8942 WP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

CVE-2025-8942

The WP Hotel Booking WordPress plugin, in versions prior to 2.2.3 , is vulnerable to a subscriber rating manipulation flaw. The root cause is a lack of proper server-side validation for review ratings, which allows an attacker to intercept and modify requests to submit negative or out-of-range va...

CVE-2025-8942: Undefined Security Weakness

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

PT-2025-38300

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.2.3 Description The WP Hotel Booking WordPress plugin does not perform adequate server-side validation of review ratings. This allows an attacker to modify the rating value by intercepting...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to insufficient validation of requests at the server side, allows attackers to bypass security restrictions and execute SSRF attacks.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and perform an SSRF attack...

The vulnerability of the GLPI system’s request, incident, and asset inventory management, related to insufficient validation of requests on the server side, allows a perpetrator to carry out an SSRF attack.

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to carry out an SSRF attack...

GHSA-C7V7-RQFM-F44J Vaadin Platform possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

GHSA-94G8-XV23-7656 Vaadin Flow Components possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

GHSA-9GFH-4FWJ-W3RJ Vaadin Framework possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

Possibility to bypass file upload validation on the server-side

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. See CWE-20 Improper Input Validation Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is...

CVE-2025-31979

A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or w...

CVE-2025-31979

CVE-2025-31979 concerns HCL BigFix Service Management (SM). The vulnerability is a file upload validation bypass where the application fails to properly enforce file type restrictions during upload, allowing an attacker to upload unauthorized or malicious files (e.g., scripts, executables, web sh...

The vulnerability of the software for energy monitoring, EcoStruxure Power Monitoring Expert and Power Operation, arises from insufficient validation of requests on the server side. This allows attackers to execute SRF attacks.

The vulnerability of the EcoStruxure Power Monitoring Expert and Power Operation software-related programs is related to insufficient checking of requests on the server side. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of the software for energy monitoring of EcoStruxure Power Monitoring Expert and Power Operation, related to insufficient validation of requests on the server side, allows a perpetrator to execute an SSRF attack.

The vulnerability of the EcoStruxure Power Monitoring Expert and Power Operation software-related programs is related to insufficient checking of requests on the server side. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...