8486 matches found
EUVD-2023-56885
Cross-Site Request Forgery CSRF vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0...
CVE-2025-68547
Missing Authorization vulnerability in WPweb Follow My Blog Post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Follow My Blog Post: from n/a through 2.4.0...
编号撤回
PHPGurukul Employee Leave Management System is an employee leave management system from PHPGurukul Inc. A security vulnerability exists in version 2.1 of the PHPGurukul Employee Leave Management System, which stems from a cross-site request forgery in the manage-employee.php component that could...
WordPress plugin AnyWhere Elementor Pro 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
PT-2026-1270
Name of the Vulnerable Software and Affected Versions WPweb Follow My Blog Post versions through 2.4.0 Description An authorization issue exists in WPweb Follow My Blog Post, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update WPweb Follow My...
PT-2026-1282
Name of the Vulnerable Software and Affected Versions Automattic WP Job Manager versions through 2.0.0 Description The software contains a Cross-Site Request Forgery CSRF issue. CSRF allows an attacker to perform actions on behalf of an authenticated user without their knowledge. Recommendations...
CVE-2025-67315
CVE-2025-67315 affects the PHPGurukul Employee Leave Management System, version 2.1. The vulnerability is a Cross Site Request Forgery in the manage-employee.php component that can allow a remote attacker to escalate privileges. The available connected documents confirm the issue and its impact b...
EUVD-2026-0808
Cross Site Request Forgery vulnerability in Employee Leave Management System v.2.1 allows a remote attacker to escalate privileges via the manage-employee.php component...
CVE-2025-67315
...
CVE-2025-64119
A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...
CVE-2025-53597
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: License Center 2.0.36 and...
CVE-2025-64122 Nuvation Energy Multi-Stack Controller Private Key Stored on Device
Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller MSC allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller MSC: through 2.5.1...
CVE-2025-64119 Nuvation Energy BMS Client-side Authentication
A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9...
CVE-2026-21451 Bagisto has HTML Filter Bypass that Enables Stored XSS
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting XSS vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize tags, the filtering can be bypassed by manipulating the raw HTTP POST...
CVE-2026-21451
Bagisto’s CMS page editor contains a stored XSS vulnerability in versions prior to 2.3.10. The issue arises because server-side sanitization is insufficient and the UI-level filter can be bypassed by tampering the raw HTTP POST payload, allowing arbitrary JavaScript to be stored and executed when...
EUVD-2026-0757
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery CSRF. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site...
CVE-2025-66398
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...
CVE-2025-52871
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: License Center 2.0.36 and later...
CVE-2025-59389 Hyper Data Protector
An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: Hyper Data Protector 2.2.4.1 and later...