CVE-2025-55204

The CVE-2025-55204 entry concerns the Muffon desktop music client. Affected versions are prior to 2.3.0, where a one-click Remote Code Execution (RCE) vulnerability exists via a specially crafted muffon:// link. When a user visits a page or clicks the link, Muffon’s custom URL handler is triggere...

CVE-2025-67315

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2025-67315

Cross Site Request Forgery vulnerability in Employee Leave Management System v.2.1 allows a remote attacker to escalate privileges via the manage-employee.php component...

EUVD-2023-56885

Cross-Site Request Forgery CSRF vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0...

CVE-2025-68547

Missing Authorization vulnerability in WPweb Follow My Blog Post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Follow My Blog Post: from n/a through 2.4.0...

编号撤回

PHPGurukul Employee Leave Management System is an employee leave management system from PHPGurukul Inc. A security vulnerability exists in version 2.1 of the PHPGurukul Employee Leave Management System, which stems from a cross-site request forgery in the manage-employee.php component that could...

CVE-2025-67315

CVE-2025-67315 affects the PHPGurukul Employee Leave Management System, version 2.1. The vulnerability is a Cross Site Request Forgery in the manage-employee.php component that can allow a remote attacker to escalate privileges. The available connected documents confirm the issue and its impact b...

EUVD-2026-0808

Cross Site Request Forgery vulnerability in Employee Leave Management System v.2.1 allows a remote attacker to escalate privileges via the manage-employee.php component...

WordPress plugin AnyWhere Elementor Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2026-1270

Name of the Vulnerable Software and Affected Versions WPweb Follow My Blog Post versions through 2.4.0 Description An authorization issue exists in WPweb Follow My Blog Post, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update WPweb Follow My...

PT-2026-1282

Name of the Vulnerable Software and Affected Versions Automattic WP Job Manager versions through 2.0.0 Description The software contains a Cross-Site Request Forgery CSRF issue. CSRF allows an attacker to perform actions on behalf of an authenticated user without their knowledge. Recommendations...

CVE-2025-67315

...

CVE-2025-64119

A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...

CVE-2025-53597

A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: License Center 2.0.36 and...

CVE-2025-64122 Nuvation Energy Multi-Stack Controller Private Key Stored on Device

Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller MSC allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller MSC: through 2.5.1...

CVE-2025-64119 Nuvation Energy BMS Client-side Authentication

A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...

CVE-2026-21451 Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting XSS vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize tags, the filtering can be bypassed by manipulating the raw HTTP POST...

CVE-2026-21451

Bagisto’s CMS page editor contains a stored XSS vulnerability in versions prior to 2.3.10. The issue arises because server-side sanitization is insufficient and the UI-level filter can be bypassed by tampering the raw HTTP POST payload, allowing arbitrary JavaScript to be stored and executed when...

EUVD-2026-0757

Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery CSRF. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site...

CVE-2025-66398

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...