All-Dynamics enlogic:show 安全漏洞

All-Dynamics enlogic:show is a digital signage management system from All-Dynamics, Germany. A security vulnerability exists in All-Dynamics enlogic:show version 2.0.2, which stems from the presence of a session fixation vulnerability that could lead to bypassing authentication and performing...

EUVD-2023-56885

Cross-Site Request Forgery CSRF vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0...

Security Bulletin: IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410

Summary IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410. This bulletin contains information regarding the vulnerability and its fixture...

PT-2026-1282

Name of the Vulnerable Software and Affected Versions Automattic WP Job Manager versions through 2.0.0 Description The software contains a Cross-Site Request Forgery CSRF issue. CSRF allows an attacker to perform actions on behalf of an authenticated user without their knowledge. Recommendations...

CVE-2025-62081

Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through =...

CVE-2025-28973

Summary of CVE-2025-28973: The vulnerability is a Path Traversal flaw in the WordPress plugin “AA-Team Pro Bulk Watermark Plugin for WordPress” (also referred to as Pro Bulk Watermark Plugin for WordPress) affecting versions up to 2.0. The root cause is insufficient sanitization of user-supplied ...

CVE-2025-62089

Cross-Site Request Forgery CSRF vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Cross Site Request Forgery.This issue affects Mergado Pack: from n/a through = 4.2.1...

CVE-2025-62119 WordPress Add Featured Image Custom Link plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ViitorCloud Technologies Pvt Ltd Add Featured Image Custom Link custom-url-to-featured-image allows DOM-Based XSS.This issue affects Add Featured Image Custom Link: from n/a through = 2.0.0...

CVE-2025-62759 WordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Justin Tadlock Series series allows Stored XSS.This issue affects Series: from n/a through = 2.0.1...

CVE-2025-62759

CVE-2025-62759 is linked to the WordPress plugin series (Series) and is described as an authenticated (Contributor+) Stored Cross-Site Scripting via shortcode. Affected: Series ≤ 2.0.1. The connected Wordfence entry confirms the vulnerability class and the affected product/version but does not pr...

OESA-2025-2889 python-requests security update

Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...

CVE-2025-15220 SohuTV CacheCloud LoginController.java init cross site scripting

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginController.java. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be...

PT-2025-53908

Name of the Vulnerable Software and Affected Versions Product Delivery Date for WooCommerce – Lite versions through 3.2.0 Description The software contains a flaw related to incorrectly configured access control security levels, allowing unauthorized access. The issue is present in Product Delive...

CVE-2025-15204

CVE-2025-15204 affects SohuTV CacheCloud up to version 3.2.0, where the doQuartzList function in QuartzManageController.java is vulnerable to cross-site scripting. The vulnerability can be exploited remotely; exploitation details are publicly disclosed. Connected sources consistently describe the...

PT-2025-53695

Name of the Vulnerable Software and Affected Versions SohuTV CacheCloud versions up to 3.2.0 Description A security issue exists in SohuTV CacheCloud. This issue allows for cross site scripting, potentially exploitable from a remote location. The vulnerable component is the doAppAuditList functio...

CVE-2025-68668 n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands...

CVE-2025-1721

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory...

Atom CMS SQL注入漏洞

Atom CMS is an open source content management system from The Digital Craft. An SQL injection vulnerability exists in Atom CMS version 2.0, which stems from an unverified SQL injection in the id parameter of the admin index page, which could lead to a remote attacker manipulating database queries...

CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

CVE-2025-6324

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affects Easy Invoice: from n/a through = 2.0.9...