375 matches found
CVE-2025-7885 Huashengdun WebSSH Login Page cross site scripting
A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched...
webssh 代码注入漏洞
webssh is a web-based ssh client by the individual developer Shengdun Hua. A code injection vulnerability exists in WebSSH 1.6.2 and earlier versions, which originates from cross-site scripting due to incorrect manipulation of the hostname/port parameter by the Login Page component...
CVE-2025-52571
Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known...
CVE-2025-52571
Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known...
CVE-2025-52571 Hikka vulnerable to RCE through edits in a channel
Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known...
CVE-2025-52571 Hikka vulnerable to RCE through edits in a channel
Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known...
CVE-2025-52571 Hikka vulnerable to RCE through edits in a channel
Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known...
CVE-2025-52571
Hikka is a Telegram userbot vulnerable to an unauthenticated credential/remote access issue in all versions below 1.6.2. The root cause enables an attacker to gain access to a victim’s Telegram account and full control of the server. The vulnerability is patched in version 1.6.2; no public workar...
WordPress plugin Related Products Manager for WooCommerce 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...
CVE-2025-27362
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Petito bw-petito allows PHP Local File Inclusion.This issue affects Petito: from n/a through 1.6.6...
CVE-2025-27362 WordPress Petito theme < 1.6.6 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Petito bw-petito allows PHP Local File Inclusion.This issue affects Petito: from n/a through 1.6.6...
CVE-2024-3249
The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importxmldata, xmldataimport, importoptiondata, importwidgets, and importcustomizersettings functions in all versions up to, and including, 1.6.2. This...
CVE-2024-36532
Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-12478
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function uploadfile of the file /index.php/upload/uploadfile/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The...
CVE-2024-31621
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...
CVE-2023-37966
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2...
CVE-2021-33027
Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce...
CVE-2015-9449
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php accountid parameter...
CVE-2025-48115
Cross-Site Request Forgery CSRF vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through = 1.6.4...