iPublish AdPortal 代码注入漏洞

iPublish AdPortal is a self-service newspaper advertising platform from iPublish, Inc. A security vulnerability exists in iPublish AdPortal version 3.0.39 that stems from the presence of server-side template injection SSTI, which allows remote attackers to execute arbitrary code via the...

Exploit for CVE-2025-22352

1️⃣ Component type WordPress plugin 2️⃣ Component details...

CVE-2025-0226 Tsinghua Unigroup Electronic Archives System downLoad.html download information disclosure

A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.21080262532. Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. T...

CVE-2025-0200

A vulnerability has been found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /user/searchnum.php. The manipulation of the argument search leads to sql injection. The attack can...

PT-2025-3227 · Unknown · Gs Coaches

Name of the Vulnerable Software and Affected Versions: GS Coaches versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This stored XSS vulnerability is present in GS Plugins GS Coaches,...

PT-2025-52553

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Multiple security issues were identified in MediaWiki, a website engine used for collaborative work. These issues could lead to...

PT-2024-17866 · Unknown · 1000 Projects Human Resource Management System

Name of the Vulnerable Software and Affected Versions: 1000 Projects Human Resource Management System version 1.0 Description: A critical issue has been found in the processing of the file /employeeview.php, where the manipulation of the search argument leads to SQL injection. The attack can be...

PT-2024-17774 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A problem has been found in the file / email.php, affecting an unknown functionality. The manipulation of the email argument leads to cross-site scripting. The attack can be launched...

CVE-2024-11411

The CVE-2024-11411 entry concerns the Spotlightr WordPress plugin, where a Stored Cross-Site Scripting (XSS) flaw exists via the spotlightr-v shortcode. The initial description states versions up to 0.1.9 are affected due to insufficient input sanitization/output escaping for user-supplied attrib...

CVE-2024-8968

The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisit...

PT-2024-17633 · WordPress · Embed Twine

Name of the Vulnerable Software and Affected Versions: Embed Twine plugin for WordPress versions up to, and including, 0.1.0 Description: The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed twine' shortcode due to insufficient input sanitizati...

Microsoft Edge (Chromium-Based) Multiple Vulnerabilities - (Dec-2 2024)

Microsoft Edge Chromium-Based is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

systeminformation 代码注入漏洞

systeminformation is an Npm software library that can obtain information about the operating system. A code injection vulnerability exists in systeminformation version 5.23.6 and earlier. An attacker can exploit this vulnerability to remotely execute code or elevate privileges...

AZL-54434 CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

Malicious code in @saferpay/logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 00760b75ef6449f1f4125794bd96880aae15b6a332fb2103a23c849e0d0d01f2 The OpenSSF Package Analysis project identified '@saferpay/logging' @ 5.9.1 npm as malicious. It is considered malicious because: - The package...

CVE-2023-38483

Missing Authorization vulnerability in dylanblokhuis Instant CSS instant-css allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through = 1.1.4...

PT-2024-12830 · Supsystic · Popup By Supsystic

Name of the Vulnerable Software and Affected Versions: Popup by Supsystic versions 1.10.19 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This exposes broken access control,...

WordPress plugin Greenshift 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-16697 · WordPress · Members – Membership & User Role Editor Plugin

Name of the Vulnerable Software and Affected Versions: Members – Membership & User Role Editor Plugin versions up to, and including, 3.2.10 Description: The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as administrators, via th...

PT-2024-36449 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: kashipara E-learning Management System version 1.0 Description: A SQL Injection issue was found in the /admin/delete event.php endpoint, allowing remote attackers to execute arbitrary SQL commands and gain unauthorized database access via the...