CVE-2024-56041

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through 1.9.9.5.1...

BIT-SUPERSET-2023-42504 Apache Superset: Lack of rate limiting allows for possible denial of service

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...

CVE-2024-1202

Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before v1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2024-10244

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ISDO Software Web Software allows SQL Injection. This issue affects Web Software: before 3.6...

CVE-2024-9842

Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders...

CVE-2024-51684

Cross-Site Request Forgery CSRF vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through 1.8.6...

Spatie Browsershot 安全漏洞

Spatie Browsershot is a codebase for converting browser pages into PDF or image formats based on Php and Javascript by the Belgian Spatie team. A security vulnerability exists in Spatie Browsershot versions prior to 5.0.5, which stems from an improper input validation vulnerability that could lea...

CVE-2024-0715

Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: before 8.8.7-03...

CVE-2024-0857

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0...

CVE-2025-20901

Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory...

WordPress WP All Export Pro plugin < 1.9.2 - Authenticated (Shop Manager+) Remote Code Execution vulnerability

Authenticated Shop Manager+ Remote Code Execution vulnerability discovered by ? in WordPress Plugin WP ALL Export Pro versions 1.9.2...

PT-2025-1623 · WordPress · Eventer

Name of the Vulnerable Software and Affected Versions: Eventer plugin for WordPress versions prior to 3.9.10 Description: The issue allows unauthorized access to data due to a missing capability check on the eventer export bookings csv function. This enables authenticated attackers with...

Rockwell Automation FactoryTalk AssetCentre 安全漏洞

Rockwell Automation FactoryTalk AssetCentre is an application from Rockwell Automation, Inc. It provides centralized tools for protecting, managing, version controlling, tracking, and reporting information about automation-related assets throughout the plant. A security vulnerability exists in...

Zoom Jenkins Marketplace plugin 安全漏洞

Zoom Jenkins Marketplace plugin is a plugin from Zoom USA. A security vulnerability exists in Zoom Jenkins Marketplace plugin versions prior to 1.4 that originates from storing sensitive information in plaintext. An attacker can exploit the vulnerability to disclose sensitive information...

DEBIAN-CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

Snowflake Connector for Python SQL注入漏洞

Snowflake Connector for Python is an open source interface from Snowflake Computing. It is used to develop Python applications that can connect to Snowflake and perform all standard operations. A SQL injection vulnerability exists in Snowflake Connector for Python versions prior to 3.13.1, which...

AZL-56005 CVE-2024-45336 affecting package golang for versions less than 1.23.7-1

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however,...

CVE-2025-22609 Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of I...

WordPress plugin Youtube Video Grid 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

AZL-55953 CVE-2024-11218 affecting package podman for versions less than 5.6.1-2

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...