4579 matches found
CVE-2024-28025
Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...
CVE-2024-28026
Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...
CVE-2024-28000
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through = 6.3.0.1...
CVE-2024-44000
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through 6.5.0.1...
CVE-2024-8259
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was...
CVE-2025-0681
CVE-2025-0681 concerns New Rock Technologies Cloud Connected Devices. The Cloud MQTT service supports wildcard topic subscriptions, enabling an attacker to tap service communications and potentially obtain sensitive information. Documented impact is information disclosure via local access to the ...
CVE-2025-0681 New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols
The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications...
CVE-2025-0680
The CVE-2025-0680 entry concerns New Rock Technologies Cloud Connected Devices suffering an OS command injection vulnerability in the device cloud RPC handling path. Affected software/components are the Cloud Connected Devicesβ RPC command processing mechanism; root cause appears to be improper h...
CVE-2025-0680 New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.
Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud...
PT-2025-02: Access to files or directories to external paties in TCPDF
The vulnerability was identified in TCPDF, version 6.8.0. The discovered vulnerability allows an attacker to transmit a specially created HTML file containing an image in Base64 format. Using the specified payload, the attacker can access an arbitrary image outside of the directory. Vulnerability...
CVE-2025-24636
Cross-Site Request Forgery CSRF vulnerability in Rick Laymance MachForm Shortcode machform-shortcode allows Stored XSS.This issue affects MachForm Shortcode: from n/a through = 1.4.1...
CVE-2025-24636
CVE-2025-24636 : WordPress MachForm Shortcode (Laymance Technologies LLC) has a CSRF to Stored XSS vulnerability affecting MachForm Shortcode versions up to 1.4.1. The vulnerability is rated with CVSSv3.1 base score 7.1 (HIGH). Public references indicate the issue exists in the plugin from n/a th...
CVE-2025-24636 WordPress MachForm Shortcode plugin <= 1.4.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Rick Laymance MachForm Shortcode machform-shortcode allows Stored XSS.This issue affects MachForm Shortcode: from n/a through = 1.4.1...
I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies
I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies. Last year, 74 vulnerabilities were classified as trending to compare the scale, just over 40,000 were added to NVD in 2024. All trending vulnerabilities are found in Western commercial products and...
CVE-2025-23776
Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through = 1.0.4.2...
CVE-2025-23426
Cross-Site Request Forgery CSRF vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through = 1.0...
CVE-2025-23776 WordPress Cache Sniper for Nginx plugin <= 1.0.4.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through = 1.0.4.2...
CVE-2025-23426
CVE-2025-23426: Red Hat and NVD reference CSRF in Wizcrew Technologies go Social that enables Stored XSS. Affected: go Social (n/a to 1.0). Root cause: cross-site request forgery allows attacker-supplied data to be stored and reflected, yielding stored XSS in vulnerable contexts. Exploitation det...
CVE-2025-23426 WordPress go Social plugin <= 1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through = 1.0...
PT-2025-2943 Β· Imagination Technologies Β· Imagination Technologies Graphics Ddk
Name of the Vulnerable Software and Affected Versions: Imagination Technologies Graphics DDK version = 24.2 RTM2 Description: The kernel software installed and running inside a Guest VM may send improper commands to the GPU Firmware to subvert reconstruction activities and trigger a write of data...