2880 matches found
CVE-2025-31447
Cross-Site Request Forgery CSRF vulnerability in nertworks NertWorks All in One Social Share Tools nertworks-all-in-one-social-share-tools allows Cross Site Request Forgery.This issue affects NertWorks All in One Social Share Tools: from n/a through = 1.26...
CVE-2021-24008
An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0,...
CVE-2021-24008
An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0,...
BIT-MLFLOW-2025-1474 Weak Password Requirements in mlflow/mlflow
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...
CVE-2025-25579
TOTOLINK A3002R (V4.0.0-B20230531.1404) is affected by a Command Injection in the /bin/boa executable via the bandstr parameter. The root cause is the failure to properly filter command characters in bandstr, enabling arbitrary command execution. CVSS v3.1 base score is 9.8 (CRITICAL) with networ...
Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
Exploit Title: Progress Telerik Report Server 2024 Q1 10.0.24.305 - Authentication Bypass Fofa Dork: title="Telerik Report Server" Date: 2024-09-22 Exploit Author: VeryLazyTech GitHub: https://github.com/verylazytech/CVE-2024-4358 Vendor Homepage: https://www.telerik.com/report-server Software...
CVE-2025-26956
Summary (fact-grounded) : CVE-2025-26873 affects the Travel Booking WordPress Theme (Traveler) up to version 3.1.8. It is categorized as an Unauthenticated PHP Object Injection vulnerability due to a missing authorization check. The vulnerability is listed as Patched/Unpatched ? The connected doc...
CVE-2025-30365 SQL Injection in query_geracao_auto.php
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/sistema/controller/querygeracaoauto.php, specifically in the query parameter. This vulnerability allows the execution of arbitrary SQL...
CVE-2025-30361 WeGIA Vulnerable to Broken Authentication - Old Password Validation
WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass...
CVE-2025-26738
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Graham Quick Interest Slider quick-interest-slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through = 3.1.5...
CVE-2025-30805
Cross-Site Request Forgery CSRF vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through = 1.1.8...
CVE-2025-30786
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through = 3.1.0...
CVE-2025-30784 WordPress WP Subscription Forms plugin <= 1.2.3 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows SQL Injection.This issue affects WP Subscription Forms: from n/a through = 1.2.3...
CVE-2025-30765
CVE-2025-30765 affects Stock Sync for WooCommerce with Google Sheets (FlexStock) and was disclosed as an authenticated SQL Injection vulnerability in FlexStock <= 3.13.1. The issue has a CVSS v3.1 base score of 7.6 (HIGH) with attack vector NETWORK and privileges required HIGH, exploitable wit...
PT-2025-13070 · Unknown +1 · Ez Sql Reports Shortcode Widget +1
Name of the Vulnerable Software and Affected Versions: Eli EZ SQL Reports Shortcode Widget and DB Backup versions through 5.25.08 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...
PT-2025-24377 · Microhard · Microhard Bulletlte-Na2 +1
Name of the Vulnerable Software and Affected Versions: Microhard BulletLTE-NA2 and IPn4Gii-NA2 affected versions not specified Description: The issue is related to a post-authentication command injection problem in the AT+MFMAC command, which can lead to privilege escalation. This is an instance ...
PT-2025-13104 · Themify · Themify Event Post
Name of the Vulnerable Software and Affected Versions: Themify Event Post versions 1.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local Fi...
CVE-2025-28873
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.This issue affects Shuffle: from n/a through = 0.5...
CVE-2025-30546
Cross-Site Request Forgery CSRF vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through = 4.33...
CVE-2025-30585
Cross-Site Request Forgery CSRF vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through = 0.8...