508 matches found
wangmarket 代码注入漏洞
wangmarket is a privatized deploy your own SAAS cloud builder system for xnx3 individual developers in China. A code injection vulnerability exists in wangmarket 4.9 and earlier versions, which stems from an incorrect manipulation of the Description parameter in the file...
CVE-2025-62149
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored XSS.This issue affects Add Custom Codes: from n/a through = 4.80...
CVE-2025-62149
CVE-2025-62149 concerns the WordPress plugin “Add Custom Codes” (affected: versions up to 4.80) with an authenticated Stored XSS vulnerability. The Wordfence entry labels it as an issue exploitable by an authenticated user with the Author role, via input during web page generation. The provided d...
WordPress Team Rosters plugin <= 4.7 - Reflected Cross-Site Scripting via 'tab' vulnerability
Reflected Cross-Site Scripting via 'tab' vulnerability discovered by vgo0 in WordPress Plugin Team Rosters versions = 4.7...
PT-2025-54336
Name of the Vulnerable Software and Affected Versions OpenHook versions through 4.3.1 Description A Cross-Site Request Forgery CSRF issue exists in OpenHook, potentially allowing attackers to perform actions on behalf of authenticated users. This occurs due to insufficient protection against forg...
MongoBleed CVE-2025-14847: Critical Memory Leak in MongoDB Allowing Attackers to Extract Sensitive Data
Overview On December 19, 2025, MongoDB Inc. disclosed a critical new vulnerability, CVE-2025-14847, which has since been dubbed MongoBleed. This vulnerability is a high-severity unauthenticated memory leak affecting MongoDB, one of the world's most popular document-oriented databases. While...
PT-2025-53089
Name of the Vulnerable Software and Affected Versions wpstream versions through 4.9.5 Description An authorization issue exists in wpstream WpStream wpstream. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. Recommendations At the...
WordPress plugin WP Adminify 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...
CVE-2025-62002 BullWall Ransomware Containment file count detection bypass
BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single possibly large file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection ca...
proxychains-ng 安全漏洞
proxychains-ng is a preloaded program by rofl0r individual developers. A security vulnerability exists in proxychains-ng versions 4.17 and earlier and cc005b7 and earlier, which stems from a stack buffer overflow in the proxyfromstring function, which could lead to memory corruption or a crash...
CVE-2025-63060
Cross-Site Request Forgery CSRF vulnerability in hogash KALLYAS kallyas allows Cross Site Request Forgery.This issue affects KALLYAS: from n/a through 4.25.0...
WordPress Jobmonster theme <= 4.8.2 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Jobmonster versions = 4.8.2...
CVE-2025-67472
Cross-Site Request Forgery CSRF vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through = 4.5.5...
Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager
Summary IBM Db2 is shipped as a component of IBM Guardium Key Lifecycle Manager. Information about multiple security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...
CVE-2025-67495 ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the postlogoutredirect GET parameter. As a result, unauthenticate...
CVE-2025-53949
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated...
xunruicms 代码问题漏洞
xunruicms is a website builder framework for XunRuiCMS individual developers. A code issue vulnerability exists in xunruicms 4.7.1 and earlier versions, which stems from incorrect manipulation of the parameter v in the file admin79f2ec220c7e.php, which could lead to server-side request forgery...
CVE-2025-13945
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service...
JLSEC-2025-261 Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in...
Null source pointer passed as an argument to memcpy function within TIFFReadDirectory in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c...
