python-pymysql: SQL injection if used with untrusted JSON input

A flaw was found in PyMySQL. When processing untrusted JSON input, keys are not escaped by the escapedict function due to insufficient input sanitization, allowing an attacker to inject malicious SQL queries...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.0, which stems from a boundary error in hevcframeend in libavcodec/hevcdec.c:2947:22 when handling untrusted input. A remote...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.0, which stems from a boundary error in loadinputpicture in libavcodec/mpegvideoenc.c:1216:21 when handling untrusted input. A...

PT-2024-28409 · Async · Async

Name of the Vulnerable Software and Affected Versions: Async versions 2.6.4 and earlier, Async versions 3.2.5 and earlier Description: The issue concerns a ReDoS Regular Expression Denial of Service vulnerability while parsing a function in the autoinject function. It is noted that the supplier...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.0, which stems from a boundary error in the copycolumn parameter of libavfilter/vftiltandshift.c:189:5 when handling untrusted...

ASUS RT-AX88U 安全漏洞

The ASUS RT-AX88U is a wireless router from Asus China. A buffer overflow vulnerability exists in ASUS RT-AX88U version v3.0.0.4.38824198, which originates from an application boundary error when handling untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary cod...

CVE-2014-5470

CVE-2014-5470 affects Actual Analyzer (versions prior to 2014-08-29). The vulnerability arises from untrusted input being passed to an eval operation, enabling code execution via shell metacharacters in the input data. Connected sources show concrete details: the flaw exists in Actual Analyzer’s ...

Actual Analyzer Security Vulnerability

Actual Analyzer is a PHP tool for monitoring website traffic from Actual Analyzer, Inc. A security vulnerability exists in Actual Analyzer that stems from the use of untrusted input for some of the input data passed to the eval operation, which allows code execution via shell metacharacters...

PT-2024-6225

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.13 Django versions 5.0 through 5.0.6 Description The issue is related to a potential denial of service attack via certain inputs with a very large number of brackets in the urlize and urlizetrunc functions. This...

CVE-2014-5470

Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation...

PT-2024-10557 · Unknown · Actual Analyzer

Name of the Vulnerable Software and Affected Versions: Actual Analyzer versions prior to 2014-08-29 Description: The issue allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation. Recommendations: For versions prior to...

CVE-2024-5724

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-5649

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...

CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

Adobe Substance 3D Stager Buffer Overflow Vulnerability (CNVD-2024-36372)

Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. A buffer overflow vulnerability previously existed in Adobe Substance 3D Stager version 2.1.4, which stemmed from a boundary error when the application processed untrusted input. An attacker could exploit th...

Fuji Electric Tellus Lite V-Simulator Buffer Overflow Vulnerability (CNVD-2025-13543)

Fuji Electric Tellus Lite V-Simulator is a remote monitoring software for industrial environments from Fuji Electric Japan. Fuji Electric Tellus Lite V-Simulator suffers from a buffer overflow vulnerability that originates from a boundary error when the application processes untrusted input. An...

PT-2024-28008 · Gnu +1 · Gnu Global +1

Name of the Vulnerable Software and Affected Versions: GNU Global versions 6.6.12 and earlier Description: The issue allows code execution in situations where dbpath also known as -d is untrusted, because shell metacharacters may be used. This can lead to execution of code when dbpath is not...

CVE-2024-5871

The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'wooslgverify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. N...

ASUS Download Master 安全漏洞

ASUS Download Master is a download program from the Chinese company Asus ASUS. A buffer overflow vulnerability exists in ASUS Download Master. The vulnerability stems from a boundary error when the application handles untrusted input. An attacker could exploit the vulnerability to execute arbitra...

Fuji Electric Tellus Lite V-Simulator 安全漏洞

Fuji Electric Tellus Lite V-Simulator is a remote monitoring software for industrial environments from Fuji Electric Japan. Fuji Electric Tellus Lite V-Simulator suffers from a buffer overflow vulnerability that originates from a boundary error when the application processes untrusted input. An...