16951 matches found
CVE-2025-52923
Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command...
PT-2025-32187 · "Вебсофт Девелопмент" · Websoft Hcm
Уязвимость программного обеспечения автоматизации HR-процессов Websoft HCM связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, раскрыть защищаемую информацию...
PT-2025-26688
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.3 Description An insufficient patch for a previous issue allows unprivileged user accounts to delete files within the .git directory. This is possible because the system fails to check for symbolic links that point ...
PT-2025-26655 · Noyafa · Noyafa/Xiami Lf9 Pro
Name of the Vulnerable Software and Affected Versions: NOYAFA/Xiami LF9 Pro up to 20250611 Description: A problematic vulnerability was found in the RTSP Live Video Stream Endpoint component of the NOYAFA/Xiami LF9 Pro device. This issue leads to improper access controls, allowing for unauthorize...
CVE-2025-49126 Visionatrix Vulnerable to Reflected XSS Leading to Exfiltration of Secrets
Visionatrix is an AI Media processing tool using ComfyUI. In versions 1.5.0 to before 2.5.1, the /docs/flows endpoint is vulnerable to a Reflected XSS Cross-Site Scripting attack allowing full takeover of the application and exfiltration of secrets stored in the application. The implementation us...
CVE-2025-52968
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...
MAL-2025-5221 Malicious code in art19-web-player (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 833f7a38c823fdd26727d7a6aec9c75365b96860e4723badca46db54163128da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
BIT-GHOST-2024-34451
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers...
GHSA-5P2P-6G2C-HF7M spytrap-adb Omission of Security-relevant Information
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface...
WordPress Sala Theme <= 1.1.3 is vulnerable to PHP Object Injection
Software Sala Type Theme Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-52826 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 745dde376637 Credits Ann Required privilege Subscriber Published 23 June,...
DLA-4224-1 node-send - security update
Bulletin has no description...
PT-2025-26585 · Dragonfly · Dragonfly
Name of the Vulnerable Software and Affected Versions: dragonfly versions 1.28.18 through 1.30.1 Description: The issue is related to an Integer Overflow or Wraparound vulnerability in the dragonflydb dragonfly, specifically in the src/redis/lua/struct modules, associated with program files lua...
CVE-2025-52926
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface...
CVE-2025-52920
Innoshop through 0.4.1 allows Insecure Direct Object Reference IDOR at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products...
The vulnerability of the websGetVar function in the /goform/set_blacklist file of the LB-LINK router software allows a violator to gain full control over the device.
The vulnerability of the websGetVar function in the /goform/setblacklist file of the LB-LINK router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system command. Exploiting this vulnerability can allow a remote attacker to gain ful...
PT-2025-26645 · Convoy · Convoy
Name of the Vulnerable Software and Affected Versions: Convoy versions 3.9.0-rc3 through 4.4.0 Description: Convoy is a KVM server management panel for hosting businesses. A directory traversal vulnerability exists in the LocaleController component, allowing an unauthenticated remote attacker to...
PT-2025-26644
Name of the Vulnerable Software and Affected Versions: changedetection.io versions prior to 0.50.4 Description: The issue is related to a cross-site scripting XSS vulnerability due to errors in filters from website page change detection watches not being properly filtered. This vulnerability has...
PT-2025-26636 · Mitel · Mitel Openscape Xpressions
Name of the Vulnerable Software and Affected Versions: Mitel OpenScape Xpressions versions through V7R1 FR5 HF43 P913 Description: A vulnerability in the WebApl component could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful...
WordPress LMS Theme <= 9.1 is vulnerable to Cross Site Scripting (XSS)
Software LMS Type Theme Vulnerable versions = 9.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-52799 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fe340a188e96 Credits Ann Required privilege Unauthenticated Published ...