PT-2025-22713 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue affects Nasa Core due to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', allowing PHP Local File Inclusion...

CVE-2022-43323

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery CSRF via the Top Up Balance component under the Edit Member module...

CVE-2022-40211

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from n/a through 2.25.1...

CVE-2022-41698

Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3...

CVE-2022-47588

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1...

CVE-2021-24629

The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections...

CVE-2021-4426

The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metaboxreviewsave function. This makes it possible for unauthenticated attackers to save meta tags via a forge...

CVE-2021-26720

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-4388

The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestatesetfeatureproperty and opalestateremovefeatureproperty functions. This makes it possible for unauthenticated...

WordPress Acerola theme <= 1.6.5 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Acerola versions = 1.6.5...

CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

WordPress TableOn plugin <= 1.0.4.4 - Content Injection vulnerability

Content Injection vulnerability discovered by ch4r0n in WordPress Plugin TableOn versions = 1.0.4.4...

CVE-2019-3420

All versions up to V2.5.0EG1T5TED of ZTE ZXHN H108N product are impacted by an information leak vulnerability. An attacker could exploit the vulnerability to obtain sensitive information and perform unauthorized operations...

CVE-2019-13190

In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page...

CVE-2018-16994

An issue was discovered on PHOENIX CONTACT AXL F BK PN =1.0.4, AXL F BK ETH = 1.12, and AXL F BK ETH XC = 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-BK+ the S20-PN-BK+/S20-ETH-BK fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact. Incorrect handling ...

CVE-2012-6302

Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox...

CVE-2012-1627

Cross-site scripting XSS vulnerability in vudterm.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via taxonomy terms...

CVE-2025-43832

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through = 0.6...

CVE-2025-39454

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through = 1.30.0...

CVE-2025-47583

Cross-Site Request Forgery CSRF vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through = 10.16...