CVE-2025-7665

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

CVE-2025-59714

In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs...

Sitecore Experience Platform和Sitecore Experience Manager 安全漏洞

Sitecore Experience Platform XP and Sitecore Experience Manager XM are both products of Sitecore, a Danish company.Sitecore Experience Platform is a suite of customer digital experience platforms.Sitecore Sitecore Experience Platform is a customer digital experience platform and Sitecore Experien...

CVE-2025-7665 Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

EUVD-2025-30249

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For...

PT-2025-38538

Name of the Vulnerable Software and Affected Versions Bimser Solution Software Trade Inc. EBA Document and Workflow Management System versions 6.7.164 through 6.7.165 Description An improper authorization issue exists in Bimser Solution Software Trade Inc. EBA Document and Workflow Management...

mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

CVE-2025-0420

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

CVE-2025-0419

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting XSS. This issue affects Zirve Nova: from 235 through 20250131...

CVE-2025-0420 XSS in Mikrogrup's Paraşüt

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

CVE-2025-0420 XSS in Mikrogrup's Paraşüt

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Thread Pooling. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to...

WatchGuard Fireware OS 安全漏洞

WatchGuard Fireware OS is a software from WatchGuard USA that runs on a Firebox. A security vulnerability exists in WatchGuard Fireware OS versions 11.10.2 through 11.12.4Update1, 12.0 through 12.11.3, and 2025.1, which originates from an out-of-bounds write and could lead to the execution of...

Paraşüt 跨站脚本漏洞

Paraşüt is a cloud-based online finance and accounting management software from Paraşüt Turkey. A cross-site scripting vulnerability exists in Paraşüt versions 0.0.0.65efa44e through 20250204, which stems from improper input neutralization and could lead to cross-site scripting attacks...

PT-2025-38130

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions 2.1.4 through 2.1.5 Description An issue exists in Apache StreamPark that allows authenticated users to trigger remote command execution. Recommendations Upgrade to version 2.1.6 to resolve the issue...

CVE-2025-55111

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating ...

BIT-GITLAB-2025-1250 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or not...

CVE-2024-12367

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issue affects Vega Master: from v.1.12.35 through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within...

Vegagrup Software Vega Master 安全漏洞

Vegagrup Software Vega Master is a web-based reporting system from Vegagrup Software, Turkey. A security vulnerability exists in Vegagrup Software Vega Master versions v.1.12.35 through 20250916, which stems from a directory index that exposes sensitive system information...

CVE-2025-43794

Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers...