30611 matches found
PT-2025-51230
The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates to check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2025-55901
CVE-2025-55901 concerns TOTOLINK A3300R, firmware version V17.0.0cu.596_B20250515, where the NTPSyncWithHost function’s host_time parameter enables command injection. The Red Hat/NVD/CNNVD etc. sources confirm a vulnerability in this device, with the impact described as potential unauthorized com...
TOTOLINK A3300R 安全漏洞
TOTOLINK A3300R is a wireless router from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK A3300R V17.0.0cu.596B20250515, which originates from a command injection in the hosttime parameter of the NTPSyncWithHost function...
CVE-2025-55901
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
PT-2025-51256
Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version V17.0.0cu.596 B20250515 Description The TOTOLINK A3300R router firmware contains a command injection flaw in the NTPSyncWithHost function. The issue is triggered through the host time parameter. This allows for potentia...
CVE-2025-14673
creationtimestamp| type| source ---|---|--- 2025-12-14 14:54:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115718490887407319 2025-12-15 14:21:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115724023770054135 2026-01-12 15:02:17+00:00| seen|...
CVE-2025-14656
A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the argument schedStartTime/schedEndTime can lead to buffer overflow. The attack may be performed from remote. The exploit has been made availab...
CVE-2025-13077
The افزونه پیامک ووکامرس فوق حرفه ای جدید payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...
CVE-2025-14477
The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the filterText paramet...
Detecting Malicious Entra OAuth Apps with LLM-Based Permission Risk Scoring
This project presents a unified detection framework that constructs a complete corpus of Microsoft Graph permissions, generates consistent LLM-based risk scores, and integrates them into a real-time detection engine to identify malicious OAuth consent activity...
CVE-2025-12084
When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorithm is quadratic. Availability can be impacted when building excessively nested documents. Mitigation Mitigation for this issue is either not available or the currently...
EUVD-2025-203189
The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the filterText paramet...
EUVD-2025-203218
The افزونه پیامک ووکامرس فوق حرفه ای جدید payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...
CVE-2025-14477
The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the filterText paramet...
CVE-2025-13077
The افزونه پیامک ووکامرس فوق حرفه ای جدید payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...
RLSA-2025:22800 Moderate: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: mm: kmem: fix a NULL pointer dereference in objstockflushrequired CVE-2023-53401 kernel: RDMA/rxe: Fix incomplete state save in...
kernel-rt security update
An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...
CVE-2025-14169
The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
curl: Denial of Service (DoS) vulnerability in dedotdotify() URL path normalization
Summary A Denial of Service DoS vulnerability exists in the dedotdotify function in lib/urlapi.c that can cause excessive CPU consumption due to On² time complexity when processing URLs with malicious path patterns containing many ../ sequences. Affected Component - Component: libcurl URL API -...
