2753 matches found
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Summary A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest versionv1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Details It exists an unsafe code segment in serde.py: Python def...
CVE-2025-32248
Technical details for CVE-2025-32248 are not provided in the connected documents; no root-cause, affected components, exploit data, or fixes are included. Monitor for updates.
CVE-2025-32192
CVE-2025-32192 is a Stored XSS in Ultra Addons Lite for Elementor (Improper input neutralization during web page generation). Affected: Ultra Addons Lite for Elementor up to version 1.1.8 (root cause: insufficient sanitization of user-controlled input in web page rendering). In the connected Word...
WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Peter Thaleikis in WordPress Plugin Ai Image Alt Text Generator for WP versions = 1.1.9...
CVE-2025-2797 Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval
The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'wofficehandleuserapprovalactions' function. This makes it possible for unauthenticated attackers to approve...
FreeBSD : mozilla -- 64 bit JIT WASM read on left over memroy (a93a1d2a-109d-11f0-8195-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a93a1d2a-109d-11f0-8195-b42e991fc52e advisory. [email protected] reports: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pic...
WordPress Booster for WooCommerce plugin 4.0.1-7.2.4 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by luckybuddy in WordPress Plugin Booster for WooCommerce versions 4.0.1-7.2.4...
CVE-2025-32054
In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file...
BIT-JOOMLA-2021-26038 [20210704] - Core - Privilege escalation through com_installer
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in cominstaller lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for cominstaller is limited to super users already...
BIT-JOOMLA-2020-10240
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses...
CVE-2025-31789 WordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through = 1.9.1...
CVE-2025-30915 WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through ...
CVE-2025-2055 MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
CVE-2025-31690
Cross-Site Request Forgery CSRF vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1...
CVE-2025-3057
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...
CVE-2025-2704
OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase...
CVE-2025-31567
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through = 2.3.1...
Official Tauri Plugins 输入验证错误漏洞
Official Tauri Plugins is an official Tauri plugin from Tauri Open Source. An input validation error vulnerability exists in versions of Official Tauri Plugins prior to 2.2.1, which stems from improper protocol validation and could lead to remote code execution...