316 matches found
CVE-2025-53468 WordPress Wp tabber widget Plugin <= 4.0 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in [email protected] Wp tabber widget wp-tabber-widget allows SQL Injection.This issue affects Wp tabber widget: from n/a through = 4.0...
CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect
Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...
CVE-2025-41044
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...
CVE-2025-41055
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/dialogs...
CVE-2025-58850 WordPress Showpass WordPress Extension Plugin <= 4.0.3 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in marcshowpass Showpass WordPress Extension showpass allows Stored XSS.This issue affects Showpass WordPress Extension: from n/a through = 4.0.3...
CVE-2025-41060 Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/tree...
CVE-2025-41044
CVE-2025-41044 affects appRain CMF 4.0.5. A stored authenticated XSS exists due to improper validation of user input in the /apprain/page/manage-static-pages/create endpoint, specifically through the data[Page][name] parameter. Public sources consistently describe the vulnerability as cross-site ...
Mobile Security Framework 路径遍历漏洞
Mobile Security Framework MobSF is an automated all-in-one mobile application from Mobile Security Framework open source. Used for penetration testing, malware analysis and security assessments, it is capable of performing both static and dynamic analysis. A path traversal vulnerability exists in...
SUSE CVE-2025-58068
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted...
CVE-2025-56212
phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter...
PT-2025-34669 · Phpgurukul · Phpgurukul Hospital Management System
Name of the Vulnerable Software and Affected Versions: phpgurukul Hospital Management System version 4.0 Description: The phpgurukul Hospital Management System is susceptible to SQL Injection in the contact.php file through the pagetitle parameter. Recommendations: As a temporary workaround,...
CVE-2025-55588
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fwip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...
Shell Script Compiler 命令注入漏洞
Shell Script Compiler is a Shell Script Compiler by the individual developer Md Jahidul Hamid. A command injection vulnerability exists in Shell Script Compiler version 4.0.3 and earlier, which stems from an os command injection in the file src/shc.c function make in the component Filename Handle...
CVE-2025-55591
CVE-2025-55591 concerns TOTOLINK A3002R, specifically v4.0.0-B20230531.1404, which is reported to contain an OS command injection vulnerability in the devicemac parameter of the formMapDel endpoint. The root cause is an input handling flaw that allows an attacker to inject and execute arbitrary c...
PT-2025-33144 · Phpgurukul · Phpgurukul Hospital Management System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: A vulnerability exists in PHPGurukul Hospital Management System 4.0, affecting unknown code within the /admin/edit-doctor.php file. Manipulation of the docfees argument results in...
PHPGurukul Hospital Management System 安全漏洞
Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter Username in the file /user-login.php. An attack...
WordPress plugin WP Biographia 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...
free5GC 安全漏洞
free5GC is a 5th Generation 5G mobile core network open source project by free5GC open source. A security vulnerability exists in free5GC version 4.0.0, which stems from a buffer overflow in the AMF component that could lead to a denial of service...