1097 matches found
CVE-2025-48869 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control
Horilla is a free and open source Human Resource Management System HRMS. Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive...
CVE-2025-48868
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
CVE-2025-48868 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
CVE-2025-48868 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
Horilla 访问控制错误漏洞
Horilla is a free and open source human resources software from Horilla, Inc. An access control error vulnerability exists in Horilla version 1.3.0 that originates from an unauthenticated user being able to access an uploaded resume file by guessing or predicting the file URL, which could result ...
Horilla 跨站脚本漏洞
Horilla is a free and open source human resources software from Horilla, Inc. A cross-site scripting vulnerability exists in Horilla version 1.3.0, which stems from multiple fields in the Project and Task modules not being properly cleared for user input, and could lead to a stored cross-site...
CSZCMS 安全漏洞
CSZCMS is an open source web application by Cskaza Bassist Individual Developer that allows to manage all content and settings on a website. A security vulnerability exists in CSZCMS version 1.3.0, which stems from unauthenticated input to the execSql function in the Upgrade.php file, which could...
CVE-2025-29083
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the PluginManager.php file...
CVE-2025-29083
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the PluginManager.php file...
PT-2025-39186
Name of the Vulnerable Software and Affected Versions CSZ-CMS version 1.3.0 Description A SQL Injection issue exists in CSZ-CMS version 1.3.0. This allows a remote attacker to execute arbitrary code through the execSqlFile function located in the Plugin Manager.php file. The vulnerability is...
CSZCMS 安全漏洞
CSZCMS is an open source web application by Cskaza Bassist Individual Developer that allows to manage all content and settings on a website. A security vulnerability exists in CSZCMS version 1.3.0, which stems from the execSql function in the PluginManager.php file not filtering input correctly,...
CVE-2025-29084
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrade.php file...
PT-2025-38902
Name of the Vulnerable Software and Affected Versions LC Wizard versions through 1.3.0 Description The software contains a flaw related to improper input handling during web page creation, which can lead to Stored Cross-site Scripting XSS. This allows an attacker to inject malicious scripts into...
WordPress plugin LC Wizard 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...
SUSE SLES15 Security Update : libavif (SUSE-SU-2025:03237-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03237-1 advisory. Update to 1.3.0: - CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and...
SUSE-SU-2025:03237-1 Security update for libavif
This update for libavif fixes the following issues: Update to 1.3.0: - CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. bsc1243270 - CVE-2025-48174: Fixed an integer overflow and resultant buffer overflow in...
cargo-packaging-1.3.0+0-2.1 on GA media (moderate)
cargo-packaging-1.3.0+0-2.1 on GA media Announcement ID: openSUSE-SU-2025:15552-1 Rating: moderate Cross-References: CVE-2025-58160 CVSS scores: CVE-2025-58160 SUSE : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2025-58160 SUSE : 2.3...
WordPress Gravity Theme <= 1.3.0 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Gravity versions = 1.3.0...
WordPress A.Williams Theme <= 1.3.0 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme A.Williams versions = 1.3.0...