CVE-2025-58063 CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion

CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for D...

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

...

Linux Distros Unpatched Vulnerability : CVE-2020-11997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the sam...

WordPress plugin PuzzleMe for WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

CVE-2025-58066

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP...

CVE-2025-51667

An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection vulnerability, which may lead to partial data leakage or disruption of normal system operations...

CVE-2025-7821

CVE-2025-7821 affects the WC Plus WordPress plugin (versions up to and including 1.2.0). The vulnerability arises from a missing capability check on the pluswc_logo_favicon_logo_base AJAX action, allowing unauthenticated modification of the site favicon/logo base. CVSS v3.1 base score is 5.3 (Med...

CVE-2025-7821 WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation

The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswclogofaviconlogobase' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo...

Dpanel has an arbitrary file read vulnerability

Summary Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files. Details When a user logs into the administrative backend, this interface can read any files on the host/sever given the...

CVE-2025-53208

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to empty request bodies not being properly rejected. An attacker can cause users to perform unintended actions by tricking them into clicking malicious links through post actions. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper validating access controls at time of access. An attacker can gain unauthorized access to thread content by leveraging AI-generated posts. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper validating access controls at time of access. An attacker can gain unauthorized access to thread content by leveraging AI-generated posts. Remediation Upgrade...

PT-2025-34306 · Ftppad · Ftppad

Name of the Vulnerable Software and Affected Versions: FTPPad versions prior to 1.3.0 Description: FTPPad contains a stack-based buffer overflow in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessive...

Malicious code in @navify-platform/error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5b9e6a4a6b1cd28b115da5f53a42db16b7446f89c67032f0e75b747da1b3ef5c The OpenSSF Package Analysis project identified '@navify-platform/error' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-41253 Malicious code in @navify-platform/error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5b9e6a4a6b1cd28b115da5f53a42db16b7446f89c67032f0e75b747da1b3ef5c The OpenSSF Package Analysis project identified '@navify-platform/error' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

Malicious code in @navify-platform/i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 306d60012db44c48b4e577372019b8171e2eb15c6cfb80a9c1e5eb7df32149de The OpenSSF Package Analysis project identified '@navify-platform/i18n' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

CVE-2025-53208

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

CVE-2025-53208 WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through = 1.2.0...

CVE-2025-53208

CVE-2025-53208 is a WordPress Maya Business plugin vulnerability affecting versions up to 1.2.0. The connected Red Hat and CVE records describe an authorization bypass through a user-controlled key, enabling an attacker to access functionality not properly constrained by ACLs (Insecure Direct Obj...