CraftCMS 安全漏洞

CraftCMS is a content management system from CraftCMS, Inc. A security vulnerability exists in CraftCMS versions 4.0.0-RC1 through 4.16.5 and 5.0.0-RC1 through 5.8.6, which stems from a Twig SSTI that could lead to remote code execution...

PT-2025-34669 · Phpgurukul · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Hospital Management System version 4.0 Description: The phpgurukul Hospital Management System is susceptible to SQL Injection in the contact.php file through the pagetitle parameter. Recommendations: As a temporary workaround,...

Linux Distros Unpatched Vulnerability : CVE-2017-7177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching. CVE-2017-7177 Note that...

GHSA-3H7R-4XXJ-3MFM Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

WordPress Jobmonster Theme <= 4.8.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Jobmonster versions = 4.8.0...

CVE-2025-54670

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affects oik: from n/a through = 4.15.2...

CVE-2025-55620

A cross-site scripting XSS vulnerability in the valuateJavascript function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2025-46611

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the crypto/hisilicon/qm module related to interrupt handling for virtual functions. Specifically, the driver did not register a reserved interru...

FTP Synchronizer Professional 安全漏洞

FTP Synchronizer Professional is an FTP client software from FTP Synchronizer, Inc. A security vulnerability exists in FTP Synchronizer Professional v4.0.73.274 and prior versions, which stems from a failure to validate filename lengths when processing responses to the LIST command, which could...

CVE-2025-49400

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in osama.esh WP Visitor Statistics Real Time Traffic allows Stored XSS. This issue affects WP Visitor Statistics Real Time Traffic: from n/a through 8.2...

CVE-2025-30975 WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Code Injection.This issue affects Add Custom Codes: from n/a through = 4.80...

CVE-2025-54034 WordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects Newsletters: from n/a through = 4.10...

CVE-2025-9202 ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcomenoticeimporthandler function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-55588

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fwip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

WordPress plugin Add Custom Codes 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Shell Script Compiler 命令注入漏洞

Shell Script Compiler is a Shell Script Compiler by the individual developer Md Jahidul Hamid. A command injection vulnerability exists in Shell Script Compiler version 4.0.3 and earlier, which stems from an os command injection in the file src/shc.c function make in the component Filename Handle...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-2968 (ALAS-2025-2968)

The version of kernel installed on the remote host is prior to 4.14.355-280.672. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2968 advisory. In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: check if the new fence is...

PT-2025-33864

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.7.0 Description: A memory leak issue exists in LibTIFF due to the functions TIFFmallocExt, TIFFCheckRealloc, TIFFHashSetNew, and InitCCITTFax3 within the tools/tiffcmp.c file of the tiffcmp component. The issue is restricted...

Linux Distros Unpatched Vulnerability : CVE-2016-8645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service system crash via a crafted...

CVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...