CVE-2024-57608

An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component...

CVE-2024-13235

The Pinpoint Booking System – 1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up to, and including, 2.9.9.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

mysql: MySQL Server: Denial of Service vulnerability via network access

A flaw was found in MySQL Server. This vulnerability allows a high privileged attacker to cause a hang or frequently repeatable crash complete Denial of Service DOS via network access using multiple protocols...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: macintosh/via-macii: Fixed “BUG: sleeping function called from invalid context”. The via-macii ADB driver calls requestirq after disabling hard interrupts. However, disabling interrupts is not necessary here, because the VIA shif...

PT-2025-5845 · Forever · Forever Kidswatch Call Me Kw50 +1

Name of the Vulnerable Software and Affected Versions: Forever KidsWatch Call Me KW-50 version R36 YDR A3PW GM7S V1.0 2019 07 15 16.19.24 cob h Forever KidsWatch Call Me KW-60 version R36CW YDE S4 A29 2 V1.0 2023.05.24 22.49.44 cob b Description: The issue allows a malicious user to obtain...

CVE-2024-5314

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in...

SUSE CVE-2025-20088

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2024-56968

An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload...

CVE-2025-20072

Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...

CVE-2024-55923 Cross-Site Request Forgery in Indexed Search Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

RHSA-2024:1763

creationtimestamp| type| source ---|---|--- 2025-01-13 09:11:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/1356 2025-05-12 23:29:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16071...

PT-2025-3543 · Unknown · Phpgurukul Land Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Land Record System version 1.0 Description: An OS Command Injection issue was found in the /landrecordsys/admin/dashboard.php file, allowing remote attackers to execute arbitrary code via the Cookie GET request parameter. This issu...

CVE-2024-12222

CVE-2024-12222 affects Deliver via Shipos for WooCommerce (WordPress) via Reflected XSS in the dvsfw_bulk_label_url parameter, impacting all versions up to 2.1.7. Exploitation requires a user to click a crafted link; attackers can inject scripts in pages that execute in the context of the victim....

WordPress plugin Deliver via Shipos for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WordPress Deliver via Shipos for WooCommerce plugin <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter vulnerability

Reflected Cross-Site Scripting via dvsfwbulklabelurl Parameter vulnerability discovered by vgo0 in WordPress Plugin Deliver via Shipos for WooCommerce versions = 2.1.7...

CVE-2024-12337

The CVE CVE-2024-12337 affects the WordPress plugin Shipping via Planzer for WooCommerce. It is a Reflected Cross-Site Scripting vulnerability in the processed-ids parameter affecting all versions up to and including 1.0.25. The issue arises from insufficient input sanitization and output escapin...

CVE-2024-12337 Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids

The Shipping via Planzer for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘processed-ids’ parameter in all versions up to, and including, 1.0.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

SUSE CVE-2024-12426

Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remo...

WordPress plugin Shipping via Planzer for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2026-2875

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the VIA watchdog driver where an unnamed resource allocation can lead to a critical boot hang. The driver uses allocate resource to reserve a memory region for the...