4353 matches found
WordPress plugin EZ SQL Reports Shortcode Widget and DB Backup 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Next.js 13.0.x < 13.5.9 Authorization Bypass
The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware. Note that the scanner has not attempted to...
AZL-59189 CVE-2025-30472 affecting package corosync 3.0.4-3
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet...
123-x-ed-eied (>=1.0.5, <=1.0.6), @0xdeepak/wallets (0.0.2) +616 more potentially affected by CVE-2025-29927 via next (>=12.0.0, <=12.3.4)
next NPM version =12.0.0, =1.0.5, =1.0.0, =1.1.1, =0.0.2-beta.0, =0.0.2-beta.0, =0.0.7, =0.0.0, =1.2.4, =3.6.2, =3.6.13 and more Source cves: CVE-2025-29927 Source advisory: OSV:GHSA-F82V-JWR5-MFFW...
GHSA-969W-GQQR-G6J3 MLflow Cross-Site Request Forgery (CSRF) vulnerability
A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...
CVE-2025-1473
In MLflow (mlflow/mlflow), a CSRF vulnerability affects versions 2.17.0 to 2.20.1 in the Signup feature, allowing an attacker to create a new account and potentially perform unauthorized actions on behalf of the attacker’s account. The CVE-2025-1473 entry documents the flaw and its impact as Cros...
@fibus-digital/sluby (>=0.4.15, <=0.4.32-beta3), @jsprismarine/client (>=0.12.1-unstable-20241211144608, <=0.12.2-unstable-20250317172708) +2 more potentially affected by CVE-2025-30144 via fast-jwt (>=5.0.0, <=5.0.5)
fast-jwt NPM version =5.0.0, =0.4.15, =0.12.1-unstable-20241211144608, =0.12.1-unstable-20241211144608, =0.12.1-unstable-20241211144608, =0.12.2-unstable-20250317172708 Source cves: CVE-2025-30144 Source advisory: OSV:GHSA-GM45-Q3V2-6CF8...
CVE-2025-22472
Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to...
CVE-2024-49559
Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains an Use of Default Password vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2024-12992
Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6...
Dassault Systèmes ENOVIA Collaborative Industry Innovator 安全漏洞
Dassault Systèmes ENOVIA Collaborative Industry Innovator is an essential toolset for real-time, secure and structured collaboration and product content management for an engineering team at Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes ENOVIA Collaborative Indust...
Pandora FMS 安全漏洞
Pandora FMS is a monitoring system from Pandora FMS, USA. The system monitors networks, servers, virtual infrastructures, applications, etc. through visualization. A security vulnerability exists in Pandora FMS versions 700 through 777.6, which stems from improper neutralization of special elemen...
@akanjs/config (>=0.0.4, <=0.0.16), @akanjs/nest (>=0.0.4, <=0.0.16) +344 more potentially affected by CVE-2024-29409 via @nestjs/common (>=10.0.0, <=10.4.15)
@nestjs/common NPM version =10.0.0, =0.0.4, =0.0.4, =0.0.4, =0.2.1, =0.0.0, =10.0.0-prerelease.12, =10.2.2, =1.0.0, =0.0.67, =0.0.56, =1.0.1-dev.17, =0.399.0, =0.423.0 and more Source cves: CVE-2024-29409 Source advisory: OSV:GHSA-CJ7V-W2C7-CP7C...
CVE-2024-55594
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests...
CVE-2025-0652
CVE-2025-0652 affects GitLab EE/CE versions 16.9–17.7.6, 17.8.x prior to 17.8.5, and 17.9.x prior to 17.9.2. The issue enables unauthorized users to access confidential information intended for internal use. The published entries consistently describe this as an incorrect/unauthorized access auth...
Apache Traffic Server Access Control Error Vulnerability
Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. A security vulnerability exists in Apache Traffic Server versions 10.0.0 through 10.0.3, and no detailed vulnerability details are provided at this time...
MariaDB DoS Vulnerability (MDEV-32084)
MariaDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mariadb:mariadb"; if...
CVE-2025-28908
CVE-2025-28908 affects the WordPress plugin pipDisqus (versions up to 1.6). The issue is a stored XSS caused by improper neutralization of input during web page generation, allowing injected scripts to persist in stored content. The available connected documents identify the vulnerability class a...
CVE-2025-28894
CVE-2025-28894 : A CSRF to Stored XSS vulnerability exists in the WordPress plugin “List of Posts from each Category” (WordPress). Affected: plugin versions n/a through 2.0. Root cause: Cross-Site Request Forgery enabling stored XSS. Impact/visibility: stored XSS via CSRF could affect site visito...
