25807 matches found
CVE-2025-3518 File upload functionality possible even when disabled
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the...
CVE-2025-3518
CVE-2025-3518 affects Unblu Spark (and related Unblu platform components) where a user can upload a file to a conversation via direct API requests even if the file upload feature is disabled for certain use cases. The configured per-use-case enable/disable setting is bypassed by direct API upload...
CVE-2025-29621
Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This vulnerability allows attackers to manipulate application settings...
WordPress wProject Theme < 5.8.0 is vulnerable to Settings Change
Software wProject Type Theme Vulnerable versions 5.8.0 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2025-39350 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 99c3c6211330 Credits Dave Jong Patchstack Required privilege...
CVE-2025-29621
Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This vulnerability allows attackers to manipulate application settings...
RosarioSIS 安全漏洞
RosarioSIS is a free and open source student information system open sourced by Francois Jacquet. It is used to manage students, create reports and make the right decisions. A security vulnerability exists in RosarioSIS version v12.0.0 that stems from content spoofing in the theme configuration,...
SUSE CVE-2017-9466
The executable httpd on the TP-Link WR841N V8 router before TL-WR841NUNV8170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control, which allowed attackers to gain read-write access to system settings through the protected router configuratio...
CentralizedFirewall - Provides A Firewall Manager API Designed To Centralize And Streamline The Management Of Firewall Configurations
Firewall Manager API Project Installation Follow these steps to set up and run the API project: 1. Clone the Repository git clone https://github.com/adriyansyah-mf/CentralizedFirewall cd CentralizedFirewall 2. Edit the .env File Update the environment variables in .env according to your...
One API 代码注入漏洞
One API is an LLM API management and distribution system for JustSong individual developers. A code injection vulnerability exists in One API version 0.6.10 and earlier, which stems from a cross-site scripting attack caused by the operation of the Homepage Content parameter in the System Settings...
CVE-2025-3795
DaiCuo 1.3.13 is affected by a cross-site scripting (XSS) vulnerability in the SEO Optimization Settings Section. The issue arises from manipulation of an unknown functionality within that component, and the attack can be launched remotely. The exploit has been disclosed publicly. Several sources...
CVE-2025-3795 DaiCuo SEO Optimization Settings Section cross site scripting
A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimization Settings Section. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclose...
CVE-2025-1863
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related ...
CVE-2025-1863 Insecure default settings for recorder products
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related ...
CVE-2025-1863
CVE-2025-1863 affects Yokogawa recorder products with insecure default authentication settings. The default authentication is disabled, enabling network-accessible access to all settings/operations and allowing manipulation of measured values and configurations. Affected products and versions inc...
PT-2025-17258 · Yokogawa Electric · Fx1000 +12
Name of the Vulnerable Software and Affected Versions: Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders versions R5.04.01 or earlier Yokogawa Electric Corporation GM Data Acquisition System versions R5.05.01 or earlier Yokogawa Electric Corporation DX1000 / DX2000 /...
DaiCuo 安全漏洞
DaiCuo DaiCuo is an adaptive backend management framework based on ThinkPHP, Bootstrap and Jquery by China-based DaiCuo. A security vulnerability exists in DaiCuo version 1.3.13, which stems from a cross-site scripting issue in the SEO Optimization Settings component...
WordPress plugin MapPress Maps 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2025-30512
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
