CVE-2025-7319

The CVE-2025-7319 entry describes an Out-Of-Bounds Read in IrfanView CADImage Plugin during DWG file parsing, caused by insufficient validation of user-supplied data that leads to reading past the end of an allocated buffer. This results in remote code execution in the plugin’s process when a use...

phproxy 安全漏洞

phproxy is a PHP-based web proxy software from PHProxy open source. A security vulnerability exists in phproxy 1.1.1 and earlier versions, which stems from insufficient validation of the proxurl parameter input and could lead to a server-side request forgery attack...

CVE-2025-6053

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-7359

The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitorgetblock function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-6053

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-7667

The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'restrict-file-access' page. This makes it possible for unauthenticated attackers to to delete arbitra...

PT-2025-29943 · Lenovo · Lenovo Vantage

Name of the Vulnerable Software and Affected Versions: Lenovo Vantage affected versions not specified Description: Lenovo Vantage contains an improper validation issue that may allow a local attacker to execute code with elevated permissions by modifying an application configuration file...

CVE-2025-20272

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-53938 WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated...

BIT-PHP-MIN-2025-1220 Null byte termination in hostnames

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

PT-2025-29544 · Samsung · Samsung Wlan Ap Wea453E

Name of the Vulnerable Software and Affected Versions: Samsung WLAN AP WEA453e versions prior to 5.2.4.T1 Description: An unauthenticated remote command execution issue exists due to improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET...

The vulnerability of the Golang programming language, related to improper validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the Golang programming language is related to incorrect validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the XML2PDF library, related to insufficient validation of requests on the server side, allows a attacker to perform an SSRF attack.

The vulnerability of the XML2PDF library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP request...

CVE-2025-38310 seg6: Fix validation of nexthop addresses

In the Linux kernel, the following vulnerability has been resolved: seg6: Fix validation of nexthop addresses The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space...

PT-2025-29134 · Unknown · Secure-Upload

Name of the Vulnerable Software and Affected Versions: Secure-upload versions prior to 0.815.0 Description: Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service was installed on a limited number of environments. Privileged...

Amazon Linux 2023 : docker (ALAS2023-2025-1074)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1074 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

CVE-2025-6803

Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability...

The vulnerability of the Device Admin App operating system ctrlX OS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Device Admin App on the ctrlX OS platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending specially crafted HTTP requests...

PT-2025-28858 · Asustor · Asustor Adm

Name of the Vulnerable Software and Affected Versions: ASUSTOR ADM versions 4.1 through 4.3.1.R5A0 Description: The issue is related to improper input validation, allowing arbitrary values to be injected into the NAS configuration file. This could lead to system misconfiguration, breaking the...

CVE-2025-48802

CVE-2025-48802 is a Windows SMB Server spoofing vulnerability caused by improper certificate validation, enabling an authorized attacker to spoof over a network. The CVSS 3.1 base vector shows Network access, Low attack complexity, Privileges required: Low, no user interaction, with Impact: confi...