Adobe ColdFusion Improper Authorization Vulnerability

Adobe ColdFusion is a dynamic Web server platform maintained by Adobe. An improper authorization vulnerability exists in Adobe ColdFusion, which can be exploited by an attacker to submit a special request to bypass security restrictions and gain unauthorized access to the system...

media: venus: hfi: add a check to handle OOB in sfr region

...

CVE-2025-53480 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages

The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders...

CVE-2025-53480 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages

The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging due to insufficient logging on the Special:AbuseFilter/test page. An attacker can exfiltrate sensitive information by exploiting the lack of audit trails for certain actions. Remediation Upgrade mediawiki/abuse-filt...

CVE-2025-52833 WordPress LMS theme <= 9.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in designthemes LMS lms allows SQL Injection.This issue affects LMS: from n/a through = 9.2...

The vulnerability of the PlantSimCore.dll library in the Siemens Tecnomatix Plant Simulation software environment allows a perpetrator to execute arbitrary code.

The vulnerability of the PlantSimCore.dll library in the Siemens Tecnomatix Plant Simulation simulation environment involves buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created SPP files...

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

The vulnerability of HDL-T hard disk microprogramming software lies in the lack of measures taken to neutralize special elements used in the operating system’s command set, allowing a hacker to execute arbitrary code.

The vulnerability of HDL-T hard disk microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PYSEC-2025-51

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake.This issue affects Apache Airflow Providers Snowflake: before 6.4.0.Sanitation of table and stage parameters were added...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Overview apache-airflow-providers-snowflake is a Provider package apache-airflow-providers-snowflake for Apache Airflow Affected versions of this package are vulnerable to Failure to Sanitize Special Elements into a Different Plane Special Element Injection in the...

CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...

The vulnerability of Hikvision’s wireless access points’ microprogramming software lies in the lack of measures to neutralize the special elements used in the operating system commands, allowing attackers to execute arbitrary commands.

The vulnerability of Hikvision’s wireless access points’ microprogramming software is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the “Multi-Functional Export/Import in Excel” plugin, which arises from the failure to take measures to neutralize special elements, allows a perpetrator to execute arbitrary commands.

The vulnerability of the “Multi-Functional Export/Import in Excel” plugin is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the “Mass Processing of Infobox Elements (Products)” plugin, which arises from failing to take measures to neutralize special elements, allows a violator to execute arbitrary commands.

The vulnerability of the “Massive Processing of Infoblock Elements Products” plugin is related to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

SUSE CVE-2022-50185

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffer overflow in nisetmcspecialregisters The last case label can write two buffers 'mcregaddressj' and 'mcdataj' with 'j' offset equal to SMCNISLANDSMCREGISTERARRAYSIZE since there are no checks for th...

The vulnerability of the Chamilo LMS electronic learning and content management system lies in the lack of measures to neutralize special elements used within the operating system, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the Chamilo LMS electronic learning and content management system lies in the lack of measures to neutralize special elements used within the operating system, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL queries remotely...

CVE-2025-49854

CVE-2025-49854 describes an SQL Injection in WordPress Slim SEO (versions n/a through 4.5.4) due to improper neutralization of input in SQL commands. Public sources (NVD, CVE List, Patchstack entry) confirm the vulnerability exists in Slim SEO and has a patch/update path: upgrading to a version l...

The vulnerability of Dell Storage Manager’s cluster management software lies in its failure to eliminate special elements used in the operating system command. This allows a hacker to execute arbitrary code.

The vulnerability of Dell Storage Manager’s cluster management software lies in the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...