673 matches found
EUVD-2022-24879
Malicious code in bioql PyPI...
CVE-2025-9884
The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious w...
CVE-2025-9630
The CVE concerns WP SinoType (WordPress) plugin vulnerable to Cross-Site Forgery (CSRF) in versions ≤ 1.0 due to missing/incorrect nonce validation in sinotype_config, enabling unauthenticated attackers to modify typography settings if a site admin is tricked. Public details confirm affected soft...
CVE-2025-10311 Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update
The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify...
CVE-2025-40836 Ericsson Indoor Connect 8855 - Improper Input Validation Vulnerability
Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges...
CVE-2025-56710
CVE-2025-56710 describes a Cross-Site Request Forgery (CSRF) in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. The vulnerability allows an attacker to trick an authenticated user into submitting unauthorized requests to the endpoint /create-class.php, potentia...
LG Electronics AC Smart II 安全漏洞
LG Electronics AC Smart II is a centralized centralized controller for air conditioners from LG Electronics, a South Korean company. A security vulnerability exists in the LG Electronics AC Smart II that stems from a hidden form that allows unauthorized changes to the administrator's password,...
CVE-2025-9628
The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settingspage function. This makes it possible for unauthenticated attackers to modify critic...
CVE-2025-9633 LH Signing <= 2.83 - Cross-Site Request Forgery
The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect nonce validation on the pluginoptions function. This makes it possible for unauthenticated attackers to modify plugin settings via a forg...
PT-2025-34219 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.5 Description: An incorrect access control issue exists in the controllerSupplierController.java component of jshERP version 3.5. This allows unauthorized attackers to arbitrarily modify the supplier status. Recommendations:...
PT-2025-34221 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.5 Description: An incorrect access control issue exists in the controllerRoleController.java component of jshERP version 3.5. This allows unauthorized attackers to arbitrarily modify the supplier status under any account...
CVE-2024-53946
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...
WordPress HT Mega plugin has unspecified vulnerability
WordPress HT Mega plugin is an Elementor page builder plugin designed for WordPress, offering over 100 custom widgets, 360+ preset modules, and a variety of templates for blogs, sliders, collapsible menus, and other page elements. A security vulnerability exists in WordPress HT Mega plugin, which...
WordPress WP Wallcreeper Authorization Issues Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An authorization issue vulnerability exists in WordPress WP Wallcreeper, which stems from a lack of capability checking in the adminnotices hook, and can be exploited by an...
AZL-65529 CVE-2025-50081 affecting package mysql for versions less than 8.0.43-1
Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass via the InnoDB component. An attacker can cause the server to hang or crash, and may perform unauthorized update, insert, or delete operations on accessible data by sending crafted requests over the network with hi...
CVE-2025-34050
A cross-site request forgery CSRF vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration...
CVE-2025-34050
A cross-site request forgery CSRF vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration...
CVE-2025-34050
A cross-site request forgery CSRF vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration...