FreeFloat FTP Server Buffer Overflow Vulnerability (CNVD-2025-14374)

FreeFloat FTP Server is an FTP service from FreeFloat. A buffer overflow vulnerability exists in FreeFloat FTP Server, which stems from the component SET Command Handler failing to properly validate the length size of input data, no details of the vulnerability are provided at this time...

CVE-2025-0052

Pure Storage FlashBlade has a CVE-2025-0052 vulnerability: improper input validation during authentication that could cause a Denial of Service. Affected component is the authentication path; impact is high for availability. No concrete exploit details or fix/version information are provided in t...

CVE-2025-0051

CVE-2025-0051 describes an issue in Pure Storage FlashArray where improper input validation during authentication can cause a Denial of Service. The connected documents identify the affected product (FlashArray) and the root cause (input validation during authentication) with the impact being DoS...

CVE-2025-0051 FlashArray DOS Vulnerability

Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service...

CVE-2025-24471

An Improper Certificate Validation vulnerability CWE-295 in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate...

CVE-2024-34711 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...

Microsoft Outlook Remote Code Execution Vulnerability

Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally...

CVE-2025-4954 Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users author and above to upload arbitrary files such as PHP on the server...

GHSA-J226-63J7-QRQH Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Impact The application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive...

CVE-2025-49130 Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including...

CVE-2025-33031 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station ...

CVE-2025-47727

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

CVE-2025-2935

CVE-2025-2935 (WordPress Wordfence entry confirmed) : The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 2024.7. The root cause is missing or incorrect nonce validation in the files ss_option_ma...

CVE-2025-2935 Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ssoptionmaint.php' and 'ssuserfilterlist' files. This make...

Arbitrary File Upload

xyz.erupt, erupt is vulnerable to arbitrary file upload. The vulnerability is due to improper validation in the /upload/GoodsCategory/image component, allowing attackers to upload crafted files and execute arbitrary code...

FreeScout Cross-Site Scripting Vulnerability (CNVD-2025-20787)

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a cross-site scripting vulnerability that is caused by improper validation of user-supplied input during data reception. No detailed vulnerability...

PT-2025-24306 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: An improper certificate validation issue has been reported, allowing a remote attacker with a user account to compromise the system's security. Recommendations: For versions prior to...

QNAP File Station 5 信任管理问题漏洞

QNAP File Station 5 is a file management system launched by Weilian Technology, which is mainly used for file management of NAS devices. A trust management issue vulnerability exists in QNAP File Station 5, which stems from improper certificate validation, and can be exploited by an attacker to...

VMware NSX Manager UI 安全漏洞

VMware NSX Manager UI is a graphical interface for configuring and managing NSX network environments from VMware, Inc. A security vulnerability exists in VMware NSX Manager UI that stems from improper input validation and could lead to a stored cross-site scripting attack...

PT-2025-23843 · Vmware · Vmware Nsx Manager Ui

Name of the Vulnerable Software and Affected Versions: VMware NSX Manager UI affected versions not specified Description: The issue is related to a stored Cross-Site Scripting XSS attack due to improper input validation. This allows an attacker to inject malicious scripts into the system. No...