CVE-2025-31120 NamelessMC Vulnerable to Cookie-Based View Count Manipulation

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie nl-topic-t...

NamelessMC 安全漏洞

NamelessMC is a free, easy to use and powerful website software from the NamelessMC team. For your Minecraft server, which contains tons of features. A security vulnerability exists in NamelessMC 2.1.4 and earlier versions, which stems from an insecure forum page view counting mechanism that coul...

PT-2025-17313 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue concerns an insecure view count mechanism in the forum page of NamelessMC, a free website software for Minecraft servers. This mechanism relies on a client-side cookie nl-topic-tid or...

CVE-2025-30737

Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion component: Core Smart View. The supported version that is affected is 24.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Smart View for Office...

CVE-2025-2564 Unauthorized View Access to Archived Channel Member Info

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in the SessionHasPermissionToChannel function, even when the "Allow users to view archived channels" System Console settin...

CVE-2025-27571 Channel metadata visible in archived channels despite configuration setting

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived...

CVE-2025-30737

Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion component: Core Smart View. The supported version that is affected is 24.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Smart View for Office...

CVE-2025-30737

Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion component: Core Smart View. The supported version that is affected is 24.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Smart View for Office...

CVE-2025-30737

Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion component: Core Smart View. The supported version that is affected is 24.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Smart View for Office...

CVE-2020-18243

SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php...

Oracle Smart View for Office 安全漏洞

Oracle Smart View for Office is a full-featured tool from Oracle Corporation Oracle for accessing and integrating enterprise performance management, business intelligence, and general ledger content in Microsoft Office products. A security vulnerability exists in Oracle Smart View for Office...

Enricozab CMS 安全漏洞

Enricozab CMS is a content management system by Enrico Zabayle Personal Developer. A security vulnerability exists in Enricozab CMS version v.1.0, which stems from /hdo/hdo-view-case.php not properly filtering inputs, which could lead to remote execution of arbitrary code...

PT-2025-16470 · Oracle · Oracle Smart View For Office

Name of the Vulnerable Software and Affected Versions: Oracle Smart View for Office version 24.200 Description: The issue allows a high privileged attacker with network access via HTTP to compromise Oracle Smart View for Office. Successful attacks require human interaction from a person other tha...

DEBIAN-CVE-2025-32072

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43...

CVE-2024-52280

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b...

CVE-2025-29017

A Remote Code Execution RCE vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profilepic parameter within pagesviewclient.php...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the endpoints listed below. An attacker can manipulate user data or configuration settings, and perform unauthorized actions by convincing users to follow malicious links that execute unintended...

e-Diary Management System view-note.php File SQL Injection Vulnerability

The e-Diary Management System is an electronic diary management system. The e-Diary Management System suffers from a SQL injection vulnerability that originates from a missing validation of externally entered SQL statements in the parameter mark of the view-note.php file. An attacker can exploit...

Bus Pass Management System view-pass-detail.php File SQL Injection Vulnerability

Bus Pass Management System is a bus pass management system. Bus Pass Management System suffers from a SQL injection vulnerability that originates from a missing validation of an externally entered SQL statement in the viewid parameter of the view-pass-detail.php file. An attacker can exploit this...