CVE-2025-55076

A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system, which may allow a local user to execute arbitrary commands wi...

Halo CMS 安全漏洞

Halo CMS is a blog and content management system from China-based Lingxia Halo. A security vulnerability exists in Halo CMS version 2.21, which originates from unauthenticated user input in the Thumbnail via-uri endpoint and could lead to a server-side request forgery attack...

WordPress plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-40306

Name of the Vulnerable Software and Affected Versions TS3 Manager versions 2.2.1 and earlier Description TS3 Manager, a web interface for Teamspeak3 servers, contains a flaw that allows an unauthenticated attacker to terminate the application. This occurs by submitting specially crafted Unicode...

CSZCMS 安全漏洞

CSZCMS is an open source web application by Cskaza Bassist Individual Developer that allows to manage all content and settings on a website. A security vulnerability exists in CSZCMS version 1.3.0, which stems from unauthenticated input to the execSql function in the Upgrade.php file, which could...

Memory Allocation with Excessive Size Value

Overview isc.org/stork/backend/server/restservice is an open source ISC project providing a monitoring application and dashboard for ISC Kea DHCP and eventually ISC BIND 9. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the http.Handler functio...

CVE-2025-34523 Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection UDP. This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted...

CGM CLININET 代码注入漏洞

CGM CLININET is a hospital information management system from German company CGM. A code injection vulnerability exists in CGM CLININET, which originates when a system function receives unauthenticated user input and could lead to the execution of arbitrary code...

AiShu AnyShare 安全漏洞

AiShu AnyShare is an enterprise content management platform from China-based AiShu. AiShu AnyShare has a security vulnerability that originates from an unauthenticated and uncleaned input to the ServiceAgent API, which could lead to remote code execution...

CVE-2025-6025

The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the data-tip attribute, which makes it possible for unauthenticated attackers to apply an...

CVE-2025-6025

The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the data-tip attribute, which makes it possible for unauthenticated attackers to apply an...

CVE-2025-6025

CVE-2025-6025 concerns the Order Tip for WooCommerce plugin (WordPress) with unauthenticated input validation failure on the data-tip attribute, affecting all versions up to 1.5.4. The issue enables callers to submit tip values (including negative amounts) that can yield unauthorized discounts, p...

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities

Multiple vulnerabilities in the management and VPN web servers for Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to stop responding or reload unexpectedly,...

CVE-2012-10044

MobileCartly 1.0 is affected by an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication/authorization before invoking file_put_contents() on attacker-controlled input, allowing an unauthenticated attacker to send crafted HTTP GET reques...

Apache HTTP Server Server-Side Request Forgery Vulnerability (CNVD-2025-16609)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server suffers from a server-side request forgery vulnerability that can be exploited by an attacker to disclose NTLM...

Apache HTTP Server 代码问题漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server suffers from a server-side request forgery vulnerability that can be exploited by an attacker to disclose NTLM...

Red Hat Ansible Automation Platform 参数注入漏洞

Red Hat Ansible Automation Platform Red Hat AAP is a unified solution for enabling strategic automation from Red Hat USA. A parameter injection vulnerability exists in Red Hat Ansible Automation Platform that stems from an unauthenticated user-supplied Git URL, which could lead to command injecti...

Langroid 代码注入漏洞

Langroid is a Langroid open source tool for developing LLMs using multi-agent programming. A code injection vulnerability exists in Langroid versions prior to 0.53.15, which stems from TableChatAgent's use of pandas eval to process unauthenticated user input, which could lead to code injection...

CVE-2024-47407

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands...

Cohesive Networks VNS3 操作系统命令注入漏洞

Cohesive Networks VNS3 is a VPN Virtual Private Network solution from Cohesive Networks, Inc. Cohesive Networks VNS3 suffers from an operating system command injection vulnerability that stems from a lack of proper authentication before executing a system call using a user-supplied string. An...