CVE-2025-29094

Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Marketing/Offers and Content/Pages components...

Windows 2024.15 - Unauthenticated Desktop Screenshot Capture

Exploit Title: Windows 2024.15 - Unauthenticated Desktop Screenshot Capture Date: 2025-05-19 Exploit Author: Chokri Hammedi Vendor Homepage: https://rs.ltd Software Link: https://rs.ltd/latest.php?os=win Version: 2024.15 Tested on: Windows 10/11 with Remote for Windows helper ''' Description: -...

CVE-2022-34113

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin...

📄 Remote for Windows 2024.15 Unauthenticated Desktop Screenshot Capture

Remote for Windows version 2024.15 suffers from a missing authentication vulnerability that allows for the disclosure of desktop screenshots. Exploit Title: Remote for Windows 2024.15 - Unauthenticated Desktop Screenshot Capture Date: 2025-05-19 Exploit Author: Chokri Hammedi Vendor Homepage:...

org.opendaylight.groupbasedpolicy:features-groupbasedpolicy (0.7.4), org.opendaylight.groupbasedpolicy:odl-groupbasedpolicy-neutron-and-ofoverlay (>=0.5.0-carbon, <=0.7.4) +23 more potentially affected by CVE-2025-29313 via org.opendaylight.sfc:sfc-ovs (>=0.2.0-beryllium, <=0.10.4)

org.opendaylight.sfc:sfc-ovs MAVEN version =0.2.0-beryllium, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.6.0, =0.4.0-carbon, =0.5.0, =0.4.0-carbon, =0.4.4-carbon and more Source cves: CVE-2025-29313 Source advisory:...

GHSA-JMPX-686V-C3WX PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

Unauthorized Reflected XSS in the constructor of the Downloader class Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 8.2 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS vector v.4.0: 8.3...

Security Bulletin: IBM Asset Data Dictionary Component uses grpc-protobuf-1.50.2.jar and jettison-1.5.2.jar which is vulnerable to CVE-2023-32731 and CVE-2023-1436

Summary IBM Asset Data Dictionary Component uses grpc-protobuf-1.50.2.jar and jettison-1.5.2.jar which is vulnerable to CVE-2023-32731 and CVE-2023-1436. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2023-32731 DESCRIPTION: gRPC...

Security Bulletin: IBM Security QRadar EDR Software has weaker than expected security due to an included component (CVE-2024-39689)

Summary IBM Security QRadar EDR Software includes a vulnerable component e.g., framework library that could be identified and exploited with automated tools. This has been addressed in an update. Vulnerability Details CVEID:CVE-2024-39689 DESCRIPTION: Certifi python-certifi could provide weaker...

CVE-2024-5145

The CVE-2024-5145 entry refers to SourceCodester Vehicle Management System (up to v1.0) with a flaw in the HTTP POST Request Handler, where manipulating the file parameter in /newdriver.php enables unrestricted uploads. Multiple sources confirm remote feasibility and public disclosure of exploits...

PT-2024-15626 · Unknown · Haokekeji Yiqiniu

Name of the Vulnerable Software and Affected Versions: HaoKeKeJi YiQiNiu versions up to 3.1 Description: A critical issue has been found in the software, affecting the function http post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side...

CVE-2023-50475

An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js...

An improper access control vulnerability has been discovered in Apache Spark

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute co...

The vulnerability of Google Chrome browser’s Device Trust Connectors allows a perpetrator to execute arbitrary code.

The vulnerability of Google Chrome’s Device Connectors component is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...

Exploit for Missing Authentication for Critical Function in Properfraction Profilepress

CVE-2021-34621 - WordPress Privilege Escalation A critical vu...

PT-2023-26340 · Unknown · Bug Finder Listplace Directory Listing Platform

Name of the Vulnerable Software and Affected Versions: Bug Finder Listplace Directory Listing Platform version 3.0 Description: A vulnerability was found in the HTTP POST Request Handler component, specifically affecting some unknown functionality of the file /listplace/user/ticket/create. The...

PT-2023-22400 · Unknown · Facemoji Emoji Keyboard

Name of the Vulnerable Software and Affected Versions: Facemoji Emoji Keyboard version 2.9.1.2 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating a component. Recommendations: For Facemoji Emoji Keyboard version 2.9.1.2, consider restricting...

PT-2023-18079 · Sourcecodester · Sourcecodester Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Purchase Order Management System. The issue affects an unknown function of the file /admin/suppliers/view...

CVE-2022-37705

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the...

K16937: OpenSSL vulnerability CVE-2015-1793

Security Advisory Description Description The X509verifycert function in crypto/x509/x509vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints CA values during identification of alternative certificate chains, which allows remote attackers to spoof ...

K15653: Multiple PHP vulnerabilities

Security Advisory Description Description Following are descriptions of various PHP gdImageCrop vulnerabilities: CVE-2013-7226 Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allows remote attackers to cause a denial of service application crash or possibly...