CVE-2025-56304

Cross-site scripting XSS vulnerability in YzmCMS thru 7.3 via the referer header in the register page...

BIT-MONGODB-2025-10060 MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0...

CVE-2025-10058

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadfunction function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with...

CVE-2025-10058 WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadfunction function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with...

WordPress plugin WP Import – Ultimate CSV XML Importer for WordPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

MongoDB 6.0.x < 6.0.24 / 7.0.x < 7.0.18 / 8.0.x < 8.0.6 (SERVER-100901)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.24, 7.0 prior to 7.0.18, and 8.0 prior to 8.0.6. It is, therefore, affected by a vulnerability as referenced in the SERVER-100901 advisory. - An improper setting of the lsid field on any sharded query can cause a crash in...

PT-2025-37758

Name of the Vulnerable Software and Affected Versions Squid versions through 7.1 Description Squid web proxy cache mishandles ASN.1 encoding of long SNMP OIDs. This issue is located in the asn build objid function within lib/snmplib/asn1.c. The issue results in a stack-based buffer overflow durin...

Korzh EasyQuery SQL注入漏洞

Korzh EasyQuery is a query builder software from Korzh. A SQL injection vulnerability exists in Korzh EasyQuery 7.4.0 and earlier versions, which stems from improper handling of files/api/easyquery/models/nwind/fetch in the Query Builder UI component, which can lead to SQL injection attacks...

Sixun Business Management System 授权问题漏洞

Sixun Business Management System is a business management system from Sixun, a Chinese company. An authorization issue vulnerability exists in Sixun Business Management System version 7/11, which originates from an improper authorization in File/Adm/OperatorStop and could lead to a remote attack...

Minor update(7) for Vivaldi Android Browser 7.5

Head to the Google Play Store and download the browser. Alternatively, you can download Vivaldi from Uptodown, the Android app store. Your rating for our browser matters. ⭐️ ⭐️ ⭐️ ⭐️ ⭐️ Enjoy! Changelog The following is a list of changes since the sixth 7.5 stable, minor update: Upgraded to...

CVE-2025-10247

CVE-2025-10247 affects JEPaaS 7.2.8, specifically the doFilterInternal function in the Filter Handler. The vulnerability enables remote exploitation due to improper access control, potentially granting access to restricted functionality or data. Exploitation has been publicly disclosed according ...

Spring Authorization Server moving to Spring Security 7.0

Spring Authorization Server has come a long way since 1.0 was officially released in November 2022. Starting as a project separate from Spring Security, has allowed it to iterate quickly on feature development and ultimately grow a rich feature set for building OAuth2 Authorization Servers. It ha...

Linux Distros Unpatched Vulnerability : CVE-2018-13449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statutbuy...

Linux Distros Unpatched Vulnerability : CVE-2025-6709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC...

Linux Distros Unpatched Vulnerability : CVE-2024-51484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens wh...

WordPress WP Import – Ultimate CSV XML Importer plugin <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ FTP/SFTP Credential Exposure vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin WP Ultimate CSV Importer versions = 7.27...

WordPress WPBOT plugin < 7.1.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin ChatBot versions 7.1.0...

CVE-2025-58751 Vite middleware may serve files starting with the same name with the public directory

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the server.fs settings. Only apps that explicitly expose the Vite dev server to the network using --host or...

CVE-2025-56266

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL...

PT-2025-36462

CVE ID: CVE-2025-0005 Published: 2025-05-20T00:00:00.000Z Severity: HIGH 7.5/10 Description Information disclosure vulnerability in the API Gateway v7.2.0 allows unauthenticated remote attackers to access sensitive information via a crafted HTTP request. Root Cause Improper access control in API...