2879 matches found
PT-2025-22001 · Unknown · Polka Dots
Name of the Vulnerable Software and Affected Versions: polka dots versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...
CVE-2025-48115
Cross-Site Request Forgery CSRF vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through = 1.6.4...
PHPGurukul News Portal 注入漏洞
News Portal is a news portal. News Portal suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter pagetitle in the file /admin/aboutus.php. An attacker can exploit this vulnerability to execute illegal SQL comman...
CVE-2025-4641
Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...
CVE-2025-31926
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcaststicky allows SQL Injection.This issue affects Sticky Radio Player: from n/a through = 3.4...
CVE-2025-48115
CVE-2025-48115 is a CSRF vulnerability in the WordPress plugin ValidateCertify (versions
CVE-2025-48080 WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through = 3.7.0.2...
PT-2025-21679 · WordPress · Wp Ultimate Tours Builder
Name of the Vulnerable Software and Affected Versions: WP Ultimate Tours Builder versions 1.055 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the loopus WP Ultimate Tours Builder, allowing unauthorized actions to be performed on behalf of a user. This is a type of attac...
Flask-AppBuilder open redirect vulnerability using HTTP host injection
Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests...
CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...
PT-2025-21516 · WordPress · Gamipress
Name of the Vulnerable Software and Affected Versions: GamiPress versions prior to 1.0.1 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in administrator change them via a CSRF attack. This could potentially permit...
CVE-2025-4640 Out-of-bounds Write in pcl
Out-of-bounds Write vulnerability in PointCloudLibrary pcl allows Overflow Buffers. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITHSYSTEMZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or...
CVE-2025-3875
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability was fixed ...
CVE-2025-3875
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability affects...
CVE-2024-10864 SQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication.
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication versions before 6.5...
CVE-2024-54779
Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds is vulnerable to Cross Site Scripting XSS in widgets/log.widget.php...
GHSA-537F-GXGM-3JJQ OpenPubkey Vulnerable to Authentication Bypass
Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. References CVE-2025-3757...
CGA-GVC6-26HJ-5F8V
Bulletin has no description...
PT-2025-20820 · Sap Se · Sap S/4Hana Hcm Portugal/Sap Erp Hcm Portugal
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to a missing authorization check, allowing an unauthorized user to view the files of other companies. This could lead to the disclosure of personal data of employees...