8489 matches found
WordPress plugin List of Posts from each Category 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an applicatio...
OpenMRS 跨站请求伪造漏洞
OpenMRS is an open source electronic medical record system from OpenMRS, Inc. A cross-site request forgery vulnerability exists in OpenMRS version 2.4.3, which stems from a cross-site request forgery issue that could lead to arbitrary operation execution...
CVE-2025-25907
tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...
CVE-2025-26933 WordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through =...
Unifiedtransform 访问控制错误漏洞
Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0, which stems from an access control error that could lead to teachers updating other teachers' personal data...
Unifiedtransform 跨站脚本漏洞
Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0, which stems from a cross-site scripting vulnerability in the Create assignment function...
VisiCut 代码问题漏洞
VisiCut is a tool by Thomas Oster, a personal developer. A security vulnerability exists in VisiCut version 2.1, which stems from unsafe XML deserialization in the loadPlfFile method of VisiCutModel.java, which could lead to code execution...
Unifiedtransform 访问控制错误漏洞
Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0 that stems from improper access control and could lead to students modifying exam rules...
ftcms 代码注入漏洞
ftcms is a content management system from ftcms Inc. A code injection vulnerability exists in version 2.1 of ftcms, which stems from an incorrect manipulation of the parameter title that could lead to a cross-site scripting attack...
CVE-2025-25908
CVE-2025-25908 affects tianti v2.3 with a stored XSS in the coverImageURL parameter at /article/ajax/save. Root cause: unsanitized input in the coverImageURL field leading to arbitrary web scripts/HTML execution. Impact: potential exposure of user data due to crafted payloads; CVSS 3.1 base score...
ftcms 注入漏洞
ftcms is a content management system from ftcms Inc. An injection vulnerability exists in ftcms version 2.1, which stems from the fact that incorrect manipulation of the parameter name can lead to SQL injection...
[SECURITY] Fedora 40 Update: python-spotipy-2.25.1-1.fc40
A light weight Python library for the Spotify Web API...
Sage 200 Spain 安全漏洞
Sage 200 Spain is a business management software from Sage. A security vulnerability exists in Sage 200 Spain versions prior to 2025.35.000, which stems from an SMB mandatory authentication vulnerability that could lead to an administrator-privileged user obtaining an NTLMv2-SSP hash by changing...
GHSA-P34J-R3CH-C985 Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI. This allows attackers with Agent/Extended Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted...
GHSA-69JQ-QR7W-J7QH FlowiseAI Flowise arbitrary file upload vulnerability
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...
Apollo 安全漏洞
Apollo is a genome annotation editor open-sourced by Generic Model Organism Database. A security vulnerability exists in Apollo versions prior to 2.8.0 that stems from the presence of a path information disclosure issue...
WordPress WP Click Info plugin <= 2.7.4 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP Click Info versions = 2.7.4...
WordPress Wallet System for WooCommerce plugin <= 2.6.2 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Tim Coen in WordPress Plugin Wallet System for WooCommerce versions = 2.6.2...
hzmanyun Education and Training System 注入漏洞
hzmanyun Education and Training System is an education and training system from China Man Yun hzmanyun Company. An injection vulnerability exists in version 2.1 of the hzmanyun Education and Training System, which stems from command injection...