kanidm-provision 日志信息泄露漏洞

kanidm-provision is a small utility program from the individual developers at oddlama to help configure kanidm. A log information disclosure vulnerability exists in kanidm-provision versions prior to 1.2.0, which stems from a function error in the supplied kanidm patch that causes administrator...

CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava

A vulnerability in haotian-liu/llava version 1.2.0 LLaVA-1.6 allows for Server-Side Request Forgery SSRF through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation o...

LLaVA 输入验证错误漏洞

LLaVA is an application by the individual developer Haotian Liu. An input validation error vulnerability exists in LLaVA v1.2.0, which stems from an open redirect and could allow a remote, unauthenticated attacker to redirect users to arbitrary websites...

LLaVA 代码问题漏洞

LLaVA is an application by the individual developer Haotian Liu. A code issue vulnerability exists in LLaVA version 1.2.0, which stems from insufficient validation of path parameters and could lead to a server-side request forgery attack...

LLaVA 代码问题漏洞

LLaVA is an application by Haotian Liu, a personal developer. A code issue vulnerability exists in LLaVA v1.2.0, which stems from a server-side request forgery in the POST /workergeneratestream API endpoint that could lead to unauthorized network operations...

LLaVA 跨站请求伪造漏洞

LLaVA is an application by the individual developer Haotian Liu. A cross-site request forgery vulnerability exists in LLaVA v1.2.0, which stems from cross-site request forgery and could allow an attacker to upload malicious files and execute arbitrary JavaScript code...

LLaVA 安全漏洞

LLaVA is an application by the individual developer Haotian Liu. A security vulnerability exists in LLaVA v1.2.0, which stems from improper handling of form-data in a file upload request and could lead to a denial of service attack...

CVE-2025-27603

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0...

CVE-2025-27603 XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0...

Confluence Migrator Application 安全漏洞

Confluence Migrator Application is an open source migrator application from XWiki SAS. A security vulnerability exists in Confluence Migrator Application versions prior to 1.2.0, which stems from an unescaped translation that could lead to arbitrary code execution...

CVE-2025-27410

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27413 PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...

CVE-2025-27410 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

WordPress Minimum Password Strength Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Minimum Password Strength versions = 1.2.0...

Benner ModernaNet 安全漏洞

Benner ModernaNet is a diagnostic center application from Benner. A security vulnerability exists in Benner ModernaNet version 1.2.0 and prior versions that stems from cross-site request forgery and could allow remote attacks...

PT-2025-7762 · Unknown · Wp Social Seo Booster

Name of the Vulnerable Software and Affected Versions: WP Social SEO Booster – Knowledge Graph Social Signals SEO versions 1.2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability...

WordPress QR Code for WooCommerce Plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin QR Code for WooCommerce versions = 1.2.0...

WordPress plugin Typed JS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress Wise Forms plugin <= 1.2.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Steven Pereira aka Cursed && Muktanand Kale aka Muktimantras in WordPress Plugin Wise Forms versions = 1.2.0...

PT-2025-7230 · Elementor · Vertex Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Vertex Addons for Elementor versions 1.2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject...