495 matches found
WordPress plugin Custom WooCommerce Checkout Fields Editor Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
PT-2025-36135
Name of the Vulnerable Software and Affected Versions: Payoneer Checkout versions n/a through 3.4.0 Description: A missing authorization issue exists in Payoneer Checkout, which allows content spoofing. Recommendations: Update Payoneer Checkout to a version later than 3.4.0...
WordPress plugin tli.tl auto Twitter poster 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
Digital Music Pad 安全漏洞
Digital Music Pad is a music creation and performance software from Digital Music Pad, Inc. A security vulnerability exists in Digital Music Pad version v8.2.3.3.4, which originates from parsing a .pls file without validating the length of the File1 field, which could lead to a stack buffer...
WeGIA 安全漏洞
WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A security vulnerability exists in WeGIA versions prior to 3.4.10, which stems from an SQL injection in the idfuncionario parameter in the /html/funcionario/dependenteremover.php endpoint, which could lea...
PT-2025-33924 · Lambertgroup · Lambertgroup Apollo
Name of the Vulnerable Software and Affected Versions: LambertGroup Apollo - Sticky Full Width HTML5 Audio Player versions through 3.4 Description: This issue involves improper neutralization of input during web page generation, leading to a reflected cross-site scripting XSS condition...
WeGIA SQL注入漏洞
WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A SQL injection vulnerability exists in WeGIA versions prior to 3.4.8, which stems from a SQL injection in the /html/funcionario/dependenteremover.php endpoint iddependente parameter, which could lead to ...
openjdk: Improve scripting supports (Oracle CPU 2025-07)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...
WordPress plugin Sunshine Photo Cart security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2023-22373
Cross-site scripting vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an arbitrary script and obtain the sensitive information...
CVE-2023-41139
A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process...
CVE-2023-41939
Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted typically optional permissions, like Overall/Manage to access functionality they're no longer entitled to...
CVE-2023-48353
In vsp driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed...
CVE-2022-45969
Alist v3.4.0 is vulnerable to Directory Traversal,...
CVE-2022-43332
A cross-site scripting XSS vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel...
CVE-2022-34982
The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party...
CVE-2022-34013
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery SSRF vulnerability via the Logo parameter under the Link module...
CVE-2021-20655
FileZen V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2 allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...