PT-2025-29650

Name of the Vulnerable Software and Affected Versions Oracle MySQL Server versions 8.0.0 through 8.0.42 Oracle MySQL Server versions 8.4.0 through 8.4.5 Oracle MySQL Server versions 9.0.0 through 9.3.0 Description A vulnerability exists in the Oracle MySQL Server component Server: Security:...

CVE-2025-46704

A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowing...

CVE-2025-28243

An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component...

PT-2025-29398 · D Link · Dir-818Lw

Name of the Vulnerable Software and Affected Versions: D-Link DIR-818LW versions up to 20191215 Description: A critical issue exists in D-Link DIR-818LW. The vulnerability is located within the System Time Page component. Manipulation of the NTP Server argument can lead to os command injection,...

CVE-2025-5392

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...

CVE-2025-34102 CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

A remote code execution vulnerability exists in CryptoLog PHP version, discontinued since 2009 due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in...

CVE-2025-28244

Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover...

CVE-2025-34095 Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

CVE-2025-49717

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

CVE-2025-49718

Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network...

CVE-2024-43204

SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where modheaders is configured to modify the Content-Type request or response header with a value provided in the HTTP request...

CVE-2025-53020

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue...

CLSA-2025-1752126532 httpd: Fix of 2 CVEs

CVE-2014-8109: modlua: fix LuaAuthzProvider argument handling issue - CVE-2019-10092: modproxy: fix limited cross-site scripting in modproxy error page...

Gallagher Command Centre Server 安全漏洞

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server that stems from a privilege context switching error that could lead to cross-departmental...

EFS Easy File Sharing HTTP Server 缓冲区错误漏洞

EFS Easy File Sharing HTTP Server is a file sharing software package from EFS, Inc. A security vulnerability exists in EFS Easy File Sharing HTTP Server version 7.2 that originates from a buffer overflow in the /sendemail.ghp endpoint and could lead to the execution of arbitrary code...

CVE-2025-28243

An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component...

CVE-2025-28244

Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover...

CVE-2025-28243

An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component...

Wing FTP Server 安全漏洞

Wing FTP Server is a set of cross-platform FTP server software open-sourced by Wing FTP Server. A security vulnerability exists in Wing FTP Server versions prior to 7.4.4, which originates from loginok.html disclosing the local installation path...

CVE-2025-28243

CVE-2025-28243 affects Alteryx Server v2023.1.1.460, with the Pages component vulnerable to HTML injection via a crafted script. The CVSS v3.1 vector indicates NETWORK access, HIGH impact to confidentiality and integrity, user interaction required, and no availability impact. Root cause details a...