CodeCanyon Rise CRM 3.7.0 SQL Injection

CodeCanyon Rise CRM version 3.7.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. PROOF OF CONCEPT CVE: CVE-2024-8945 Exploit Title: RISE Ultimate Project Manager 3.7 sql injection POC Google Dork: N/A Date: September 19, 2024 Exploit Author: Jobyer Ahmed...

Apache Commons VFS Information Disclosure Vulnerability

Apache Commons VFS is a public virtual file system from the Apache USA Foundation. Apache Commons VFS prior to version 2.10.0 suffers from an information disclosure vulnerability that stems from the FtpFileObject class that may disclose the original URI containing the password if the file is not...

CVE-2025-23666

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cxc-sawa Management-screen-droptiles cxc-sawa allows Reflected XSS.This issue affects Management-screen-droptiles: from n/a through = 1.0...

WordPress plugin Jobs for WordPress 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

WordPress Advanced Form Integration 1.82.0 SQL Injection / Cross Site Scripting

WordPress Advanced Form Integration plugin versions 1.82.0 and below suffer from a remote SQL injection vulnerability that can be leveraged for cross site scripting attacks. CVE-2024-2387 Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms =...

CVE-2025-0188

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

TeamPass 3.0.0.21 - SQL Injection

Exploit Title: TeamPass SQL Injection Google Dork: intitle:"Teampass" + inurl:index.php?page=items Date: 02/23/2025 Exploit Author: Max Meyer - Rivendell Vendor Homepage: http://www.teampass.net Software Link: https://github.com/nilsteampassnet/TeamPass Version: 2.1.24 and prior Tested on:...

123-x-ed-eied (>=1.0.5, <=1.0.6), @a11ywatch/web (0.3.0) +614 more potentially affected by CVE-2025-29927 via next (>=12.0.0, <=12.3.4)

next NPM version =12.0.0, =1.0.5, =1.0.0, =1.1.1, =0.0.2-beta.0, =0.0.2-beta.0, =0.0.7, =0.0.0, =1.2.4, =3.6.2, =1.0.0, =2.0.0-bundle-perf-test.2 and more Source cves: CVE-2025-29927 Source advisory: OSV:GHSA-F82V-JWR5-MFFW...

agentverse (0.1.8.1), airoboros (2.1.1) +32 more potentially affected by CVE-2024-10912 via fschat (>=0.2.2, <=0.2.36)

fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 and more Source cves: CVE-2024-10912 Source advisory: SNYK:PYTHON-FSCHAT-9553179...

CVE-2024-10950

In binary-husky/gptacademic version = 3.83, the plugin CodeInterpreter is vulnerable to code injection caused by prompt injection. The root cause is the execution of user-provided prompts that generate untrusted code without a sandbox, allowing the execution of parts of the LLM-generated code. Th...

@fibus-digital/sluby (>=0.4.15, <=0.4.32-beta3), @jsprismarine/client (>=0.12.1-unstable-20241211144608, <=0.12.2-unstable-20250317172708) +2 more potentially affected by CVE-2025-30144 via fast-jwt (>=5.0.0, <=5.0.5)

fast-jwt NPM version =5.0.0, =0.4.15, =0.12.1-unstable-20241211144608, =0.12.1-unstable-20241211144608, =0.12.1-unstable-20241211144608, =0.12.2-unstable-20250317172708 Source cves: CVE-2025-30144 Source advisory: OSV:GHSA-GM45-Q3V2-6CF8...

@akanjs/config (>=0.0.4, <=0.0.16), @akanjs/nest (>=0.0.4, <=0.0.16) +344 more potentially affected by CVE-2024-29409 via @nestjs/common (>=10.0.0, <=10.4.15)

@nestjs/common NPM version =10.0.0, =0.0.4, =0.0.4, =0.0.4, =0.2.1, =10.0.0-prerelease.12, =10.2.2, =1.0.0, =0.0.67, =0.0.56, =1.0.1-dev.17, =0.399.0, =2.2.7-bb.3, =2.2.7-bb.7 and more Source cves: CVE-2024-29409 Source advisory: OSV:GHSA-CJ7V-W2C7-CP7C...

Microsoft Project 2016 RCE Vulnerability (KB5002561)

This host is missing a critical security update according to Microsoft KB5002561 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Acrobat Reader Font VariationStore itemVariationDataCount Uninitialized Pointer Vulnerability

Talos Vulnerability Report TALOS-2025-2135 Adobe Acrobat Reader Font VariationStore itemVariationDataCount Uninitialized Pointer Vulnerability March 12, 2025 CVE Number CVE-2025-27158 SUMMARY A memory corruption vulnerability exists due to the use of an uninitialized pointer in the Font...

CVE-2024-13918

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page...

a2 (>=0.2.0, <=0.8.1), aati (>=0.10.2, <=0.11.3) +5509 more potentially affected by CVE-2025-4432 via ring (>=0.13.5, <=0.17.9)

ring CARGO version =0.13.5, =0.2.0, =0.10.2, =0.1.0, =0.2.0-beta.4, =0.21.0-alpha.1, =0.1.1, =0.11.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.11.3, =0.1.27, =0.2.1 and more Source cves: CVE-2025-4432 Source advisory: OSV:RUSTSEC-2025-0009...

WordPress plugin Shortcodes Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

openSUSE Security Advisory (openSUSE-SU-2024:0005-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-56810 IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system...