2880 matches found
CVE-2025-29085
SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component...
PT-2025-14886 · WordPress · Wpforo Forum
Name of the Vulnerable Software and Affected Versions: wpForo Forum versions 2.4.2 and earlier Description: The issue is related to an Incorrect Privilege Assignment, which allows Privilege Escalation in the wpForo Forum. Recommendations: For versions 2.4.2 and earlier, update to a version that...
CVE-2025-31814
Cross-Site Request Forgery CSRF vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through = 1.2.0...
CVE-2025-31779
Cross-Site Request Forgery CSRF vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through = 1.5.54...
CVE-2025-3159
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buff...
CVE-2025-31903
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through = 2.0.0...
BIT-DOLIBARR-2022-22293
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAINMAXDECIMALSTOT parameter...
BIT-DOLIBARR-2022-2060 Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
Cross-site Scripting XSS - Stored in GitHub repository dolibarr/dolibarr prior to 16.0...
CVE-2024-53868 Apache Traffic Server: Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue...
PT-2025-14782 · Element · Element
Name of the Vulnerable Software and Affected Versions: Element X Android versions 0.4.16 through 25.03.3 Description: The issue allows an entity in control of the element.json well-known file to access media encryption keys used for an Element Call under certain conditions. Recommendations: For...
PT-2025-14803 · Unknown · Student-Manage
Name of the Vulnerable Software and Affected Versions: student-manage version 1 Description: The issue allows a local attacker to escalate privileges due to insecure permission verification. This is achieved through the unsafe permission verification process. Recommendations: For version 1,...
SUSE-SU-2025:1099-1 Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20250331T171002 2025-03-31T17:10:02Z jscPED-11136 GO-2025-3443 GO-2025-3548 GO-2025-3557 GO-2025-3558 GO-2025-3559 - Update to version 0.0.20250327T184518 2025-03-27T18:45:18Z jscPED-11136 GO-2025-3526...
CVE-2025-31135
Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is...
CVE-2025-31880
Cross-Site Request Forgery CSRF vulnerability in Stylemix Pearl pearl-header-builder allows Cross Site Request Forgery.This issue affects Pearl: from n/a through = 1.3.9...
CVE-2025-31828
Cross-Site Request Forgery CSRF vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through = 1.4.2...
CVE-2025-31796
Server-Side Request Forgery SSRF vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Server Side Request Forgery.This issue affects ElementsCSS Addons for Elementor: from n/a through = 1.0.8.9...
CVE-2025-31808
Technical details for CVE-2025-31808 are not publicly available in the provided documents. No affected product/version, impact, exploit info, or fix is disclosed here. Monitor for updates.
Malformed MongoDB wire protocol messages may cause mongos to crash
Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to...
MongoDB Server may crash due to improper validation of explain command
When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...