EUVD-2025-200137

Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service...

PT-2025-48665

The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of the download feature that could allow a remote attacker to bypass download protection via a specially crafted HTML...

PT-2025-48689

Name of the Vulnerable Software and Affected Versions Datactive versions 2.13.34 through 2.14.0.5 Description The software contains a flaw related to improper handling of user-supplied data during web page creation, specifically a Stored Cross-site Scripting XSS issue. This allows for the injecti...

CVE-2024-53684

A cross-site request forgery csrf vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to unauthorized access. An attacker can stage a malicious webpage to trigger this vulnerability...

EUVD-2025-199832

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

@langri-sha/projen-license (>=0.1.0 <=0.3.3), @langri-sha/projen-project (>=0.9.0 <=0.17.0) potentially affected by unknown CVE via license-o-matic (=1.2.0)

license-o-matic NPM version =1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on license-o-matic and may be impacted: - @langri-sha/projen-license =0.1.0, =0.9.0, =0.17.0 Source cves: unknown CVE Source advisory: SNYK:JS-LICENSEOMATIC-14103652...

@amorist/gatsby-theme-antd (=1.0.0), @antv/f2-site (>=4.0.0-4.0.0-alpha.3.0 <=5.0.1-beta.0) +16 more potentially affected by unknown CVE via gatsby-plugin-cname (=1.0.0)

gatsby-plugin-cname NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on gatsby-plugin-cname and may be impacted: - @amorist/gatsby-theme-antd =1.0.0 - @antv/f2-site =4.0.0-4.0.0-alpha.3.0, =0.9.81, =1.0.0, =1.1.18-beta.0, =0.0.1, =0.0.4,...

CVE-2025-54347

A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to write arbitrary files under certain conditions...

D-Link DWR-M920和D-Link DIR-822K 安全漏洞

D-Link DWR-M920 and D-Link DIR-822K are both products of China's AUO D-Link.The D-Link DWR-M920 is a router.The D-Link DIR-822K is a wireless router.The D-Link DWR-M920 and D-Link DIR-822K are both products of China's AUO D-Link.The D-Link DWR-M920 and D-Link DIR-822K are wireless routers. A...

CVE-2025-12169

The CVE-2025-12169 entry concerns ELEX WordPress HelpDesk & Customer Ticketing System (WordPress) with a missing capability check on wp_ajax_eh_crm_settings_empty_scheduled_actions, allowing authenticated subscribers (and above) to delete scheduled triggers in all versions up to 3.3.0. Connected ...

CVE-2025-12974 Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...

PT-2025-47262

Name of the Vulnerable Software and Affected Versions Top Friends plugin for WordPress versions prior to 0.4 Description The Top Friends plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF. This is caused by a lack of nonce validation within the top friends options subpanel...

Google Chrome Security Update (stable-channel-update-for-desktop_17-2025-11) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2025-10460 Unsanitized parameter input leading to SQL Injection vulnerability

A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input...

Projectworlds Advanced Library Management System SQL注入漏洞

Projectworlds Advanced Library Management System is an advanced library management system from Projectworlds India. A SQL injection vulnerability exists in Projectworlds Advanced Library Management System version 1.0, which stems from incorrect manipulation of the parameter Username in the file...

RARLabs WinRAR XSS Vulnerability (Nov 2025) - Windows

WinRAR is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rarlab:winrar";...

PT-2025-47106

A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input...

WordPress Image Gallery – Photo Grid & Video Gallery plugin <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move vulnerability

Improper Authorization to Authenticated Author+ Arbitrary Image File Move vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Modula Image Gallery versions = 2.12.28...

200-ok-boomer (>=2.0.0 <=2.1.0), 20190403-utils (=1.0.0) +6665 more potentially affected by CVE-2025-64718 via js-yaml (>=3.0.0 <=3.14.1)

js-yaml NPM version =3.0.0, =2.0.0, =1.0.0, =0.1.1, =0.1.0, =1.0.0, =0.2.39, =0.0.1, =1.0.2, =2.0.3, =0.0.327, =0.0.308, =1.0.29, =1.0.30 and more Source cves: CVE-2025-64718 Source advisory: SNYK:JS-JSYAML-13961110...