CVE-2024-12144

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Finder Fire Safety Finder ERP/CRM Old System allows SQL Injection. This issue affects Finder ERP/CRM Old System: before 18.12.2024...

CVE-2025-27412

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting XSS on the page of AddOns. This vulnerability is fixed in 5.18.3...

CVE-2024-53695

The CVE-2024-53695 entry concerns QNAP HBS 3 Hybrid Backup Sync. A buffer overflow (boundary error) in the product could, if exploited, allow a remote attacker to modify memory or crash processes. Public references in the provided documents confirm the vulnerability and indicate a fix in HBS 3 Hy...

CVE-2024-50405

CVE-2024-50405 affects QNAP QTS and QuTS hero with CRLF Injection due to improper neutralization of CRLF sequences. Affected products and versions: QTS 5.2.3.3006 build 20250108 and later; QuTS hero h5.2.3.3006 build 20250108 and later. Root cause is improper CRLF sequence handling, enabling a re...

CVE-2025-27656

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011...

CVE-2025-27672

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016...

CVE-2025-27675

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004...

Precurio Intranet Portal 4.4 Remote Command Execution

Precurio Intranet Portal version 4.4 suffers from a remote command execution vulnerability. Exploit Title: Precurio Intranet Portal 4.4 - Remote Command Execution Discovered by: Ahmet Ümit BAYRAM Discovered Date: 05.03.2024 Vendor Homepage: https://www.precurio.com Software Link:...

OpenAdmin 0.3.4 Cross Site Request Forgery

Cross site request forgery in the Users and Change Root Password functions in OpenAdmin version 0.3.4 allows remote attackers to perform attacks enabling unauthorized actions that could lead to privilege escalation. Exploit Title: OpenAdmin 0.3.4 - Multiple CSRF Vulnerabilities Date: Nov 8, 2024...

GHSA-8366-XMGF-334F REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

Summary Reflected cross-site scripting XSS is a type of web vulnerability that occurs when a web application fails to properly sanitize user input, allowing an attacker to inject malicious code into the application's response to a user's request. When the user's browser receives the response, the...

CVE-2025-27412 REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting XSS on the page of AddOns. This vulnerability is fixed in 5.18.3...

CVE-2025-25122

Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through = 3.0.2...

CVE-2025-25121

Cross-Site Request Forgery CSRF vulnerability in shyammakwana Theme Options Z theme-options-z allows Cross Site Request Forgery.This issue affects Theme Options Z: from n/a through = 1.4...

CVE-2025-23494

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in binnyva Quizzin quizzin allows Reflected XSS.This issue affects Quizzin: from n/a through = 1.01.4...

CVE-2025-23850

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mojowill Mojo Under Construction mojo-under-construction allows Reflected XSS.This issue affects Mojo Under Construction: from n/a through = 1.1.2...

CVE-2025-23814

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRUDLab CRUDLab Like Box crudlab-facebook-like-box allows Reflected XSS.This issue affects CRUDLab Like Box: from n/a through = 2.0.9...

CVE-2025-23945

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Webliup Popliup popliup allows PHP Local File Inclusion.This issue affects Popliup: from n/a through = 1.1.1...

CVE-2025-26589

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Cristopher Dino IE CSS3 Support ie-css3-support allows Reflected XSS.This issue affects IE CSS3 Support: from n/a through = 2.0.1...

CVE-2025-26540

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through = 2.0.7...

CVE-2025-23549

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in agora32 Maniac SEO maniac-seo allows Reflected XSS.This issue affects Maniac SEO: from n/a through = 2.0...