Laravel Framework 跨站脚本漏洞

Laravel Framework is a PHP-based web application development framework from the individual developer Taylor Otwell. A security vulnerability exists in Laravel Framework versions 11.9.0 through 11.35.1, which stems from improper coding of request parameters on a debug mode error page and could lea...

DEBIAN-CVE-2023-52971

MariaDB Server 10.10 through 10.11. and 11.0 through 11.4. crashes in JOIN::fixallsplittingsinplan...

CVE-2023-52970

Disclaimer: This data contains information about vulnerable...

MariaDB 安全漏洞

MariaDB is a free and open source database management system from the MariaDB Foundation and a forked version of MySQL with the Maria storage engine. A security vulnerability exists in MariaDB versions 10.10 through 10.11.x and 11.0 through 11.4.x, which stems from a crash in...

a2 (>=0.2.0, <=0.8.1), aati (>=0.10.2, <=0.11.3) +5503 more potentially affected by CVE-2025-4432 via ring (>=0.13.5, <=0.17.9)

ring CARGO version =0.13.5, =0.2.0, =0.10.2, =0.1.0, =0.2.0-beta.4, =0.21.0-alpha.1, =0.1.1, =0.11.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.11.3, =0.1.27, =0.2.2, =0.2.3 and more Source cves: CVE-2025-4432 Source advisory: OSV:RUSTSEC-2025-0009...

Apache Traffic Server 输入验证错误漏洞

Apache Traffic Server ATS is a suite of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. A security vulnerability exists in Apache Traffic Server ATS versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.8, and 10.0.0 through 10.0.3, which stems from improper...

Fixed in Apache Tomcat 9.0.102

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password. This was fixed with commits c32bbd37. This issue was reporte...

CVE-2025-22212

A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands in the submission management area in backend...

OpenTelemetry .NET 安全漏洞

OpenTelemetry .NET is the .NET client for OpenTelemetry from OpenTelemetry, Inc. A security vulnerability exists in OpenTelemetry .NET versions 1.10.0 through 1.11.1 that stems from improper handling of headers, resulting in a denial of service attack...

CVE-2024-51947 Stored XSS vulnerability in Rest Services under Layer name

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...

CVE-2025-23852

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robin90 First Comment Redirect first-comment-redirect allows Reflected XSS.This issue affects First Comment Redirect: from n/a through = 1.0.3...

CVE-2025-23518

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mrsaucier GoogleMapper googlemapper-2 allows Reflected XSS.This issue affects GoogleMapper: from n/a through = 2.0.3...

CVE-2025-23587

CVE-2025-23587 is a reflected Cross-Site Scripting vulnerability in the WordPress plugin “all-in-one-box-login”

CVE-2025-0159

IBM FlashSystem IBM Storage Virtualize 8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1 could allow a remote attacker to bypas...

PT-2025-7849 · Pickplugins · Pickplugins Wishlist

Name of the Vulnerable Software and Affected Versions: PickPlugins Wishlist versions 1.0.0 through 1.0.41 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

CVE-2025-22632

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in totalsoft WooCommerce Pricing – Product Pricing woo-pricing-table allows Stored XSS.This issue affects WooCommerce Pricing – Product Pricing: from n/a through = 1.0.9...

Eclipse Open VSX 安全漏洞

Eclipse Open VSX is an open source registry of code extensions for Eclipse open source. A security vulnerability exists in Eclipse Open VSX versions v0.9.0 through v0.20.0, which stems from the /user/namespace/namespace/details API that allows a user to edit all namespace details, even if the use...

Extreme Networks IQ Engine 安全漏洞

Extreme Networks IQ Engine is an engine by Extreme Networks, Inc. A security vulnerability exists in Extreme Networks IQ Engine versions prior to 10.6r1a and versions prior to 10.6r4 through 10.6r5, which originates from a buffer overflow in the ahwebui service...