CVE-2020-20945

A Cross-Site Request Forgery CSRF in /admin/index.php?lfj=member=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts...

CVE-2020-20981

A SQL injection in the /admin/?n=logs=index=dolist component of Metinfo 7.0 allows attackers to access sensitive database information...

CVE-2020-21126

MetInfo 7.0.0 contains a Cross-Site Request Forgery CSRF via admin/?n=admin=index=doSaveInfo...

CVE-2020-25834

Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting XSS...

CVE-2019-11621

doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user or a user with permission to manage network configuration could exploit the vulnerability to obtain database sensitive...

CVE-2019-17552

An issue was discovered in idreamsoft iCMS v7.0.14. There is a spiderproject.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload...

CVE-2019-8432

In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...

CVE-2018-13865

An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...

CVE-2013-1786

Cross-site scripting XSS vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...

WSO2 Identity Server（IS） 安全漏洞

WSO2 Identity Server IS is an identity server from the US-based WSO2 Inc. A security vulnerability exists in WSO2 Identity Server IS version 7.0.0 that stems from insufficient input validation and could lead to a reflective cross-site scripting attack...

CVE-2005-3281

Directory traversal vulnerability in NukeFixes 3.1 for PHP-Nuke 7.8 allows remote attackers to include arbitrary files via the file parameter...

CVE-2005-3016

Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors...

CVE-2024-42922

AAPanel v7.0.7 is susceptible to an OS command injection vulnerability, which can lead to remote command execution (RCE) . This issue is estimated to affect more than 3.6 million servers globally. While the vulnerability is documented, there is currently no information regarding a newer version t...

CVE-2025-39351

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Restaurant WordPress allows Cross Site Request Forgery.This issue affects Grand Restaurant WordPress: from n/a through 7.0...

CVE-2025-47749

V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

WordPress plugin Grand Restaurant 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Grand Restaurant 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-28055

upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit...

CVE-2025-28055

The application upset-gal-web version 7.1.0 is vulnerable to an arbitrary file read vulnerability located in the /api/music/v1/cover.ts endpoint. This flaw stems from an improper limitation of a pathname to a restricted directory (CWE-22), potentially allowing an attacker to read sensitive files ...

📄 VirtualBox 7.0.16 Privilege Escalation

VirtualBox version 7.0.16 suffers from a privilege escalation vulnerability. Exploit Title: VirtualBox 7.0.16 - Local Privilege Escalation Date: 2025-05-06 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Tested on: Win x64...