CVE-2010-2502

Multiple directory traversal vulnerabilities in Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allow 1 remote attackers to read arbitrary files, aka SPL-31194; 2 remote authenticated users to modify arbitrary files, aka SPL-31063; or 3 have an unknown impact via redirects, aka SPL-31067...

Atlassian Jira 10.3.x < 10.3.5 Privilege Escalation

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 9.12.2, 10.3.x prior to 10.3.5 or 10.5.x prior to 10.5.1. It is, therefore, affected by a privilege escalation vulnerability. Note that the scanner has not tested for these issues...

CVE-2025-27010

Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through 2.5.2...

Atlassian Jira Service Management Data Center and Server 5.12.4 < 5.12.22 / 5.13.x < 10.3.5 / 10.4.x < 10.5.1 DoS (JSDSERVER-16144)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a denial of service vulnerability as referenced in the JSDSERVER-16144 advisory. - A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading...

PT-2025-21994 · Unknown · Rootspersona

Name of the Vulnerable Software and Affected Versions: Rootspersona versions 3.7.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue may be exploited by an attacker to perform action...

CVE-2025-27525

Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06...

CVE-2025-4641

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

CVE-2025-47709

Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0...

CVE-2025-48079

Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through = 5.9.5.1...

CVE-2025-31637

CVE-2025-31637 is a SQL Injection vulnerability reported for the WordPress SHOUT plugin (LambertGroup SHOUT), affecting SHOUT versions n/a through 3.5.3. The vulnerability arises from improper neutralization of input in SQL commands, enabling SQL Injection. Public sources rate the impact as high ...

CVE-2025-47710

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0...

CVE-2025-47704

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting XSS.This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.5...

CVE-2025-3909

Thunderbird (email client) is affected by CVE-2025-3909 via the X-Mozilla-External-Attachment-URL header. An attacker could craft a nested message/rfc822 attachment with content type application/pdf, causing Thunderbird to render it as HTML and execute JavaScript in the file:/// context after aut...

CVE-2024-8973

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload...

CVE-2025-47480

Missing Authorization vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina: from n/a through = 3.0.4...

Apache ActiveMQ 5.16.x < 5.16.8 / 5.17.x < 5.17.7 / 5.18.x < 5.18.7 / 6.x < 6.1.6 DoS (CVE-2025-27533)

The version of Apache ActiveMQ running on the remote host is 5.16.x prior to 5.16.8, 5.17.x prior to 5.17.7, 5.18.x prior to 5.18.7, or 6.x prior to 6.1.6. It is, therefore, affected by a denial of service vulneraiblity: - During unmarshalling of OpenWire commands the size value of buffers was no...

CVE-2025-3476

Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This issue affects Operations Bridge Manager: 2023.05, 23.4, 24.2, 24.4...

CVE-2025-47551

CVE-2025-47551 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Wiki Embed plugin, affecting versions up to 1.4.6. The root cause is CSRF vulnerability leading to unauthorized settings changes. The CVSS v3.1 score is 4.3 (Medium). A fix is available in newer plugin ver...

CVE-2025-47537 WordPress PDF Invoices for WooCommerce + Drag and Drop Template Builder <= 5.3.8 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in add-ons.org PDF Invoices for WooCommerce + Drag and Drop Template Builder allows SQL Injection. This issue affects PDF Invoices for WooCommerce + Drag and Drop Template Builder: from n/a through...

CVE-2025-47497

CVE-2025-47497 pertains to the WordPress Logo Showcase plugin, affected versions are up to 3.0.4. The vulnerability is a DOM-based XSS caused by improper neutralization of input during web page generation. No explicit remediation version is provided in the connected documents; they only note the ...