Laravel File Manager 安全漏洞

Laravel File Manager is a Laravel file manager by Aleksandr Manekin Personal Developer. A security vulnerability exists in Laravel File Manager 3.3.1 and earlier versions, which stems from a flaw in the file upload functionality that could lead to remote code execution...

EUVD-2025-36163

A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-62949

CVE-2025-62949 relates to a Cross-Site Scripting (XSS) vulnerability in the WordPress/BuddyPress plugin chain: Activity Plus Reloaded for BuddyPress (bp-activity-plus-reloaded) with versions up to and including 1.1.2. The issue is described as an improper neutralization of input during web page g...

CVE-2025-62943 WordPress Next Page, Not Next Post plugin <= 0.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt McInvale Next Page, Not Next Post next-page-not-next-post allows Stored XSS.This issue affects Next Page, Not Next Post: from n/a through = 0.3.0...

CVE-2025-62887

The CVE-2025-62887 entry describes a DOM-Based XSS in WordPress Word Addons for Elementor (King Addons for Elementor). Affected product/component: King Addons for Elementor plugin for WordPress, version up to and including 51.1.37. Root cause: Improper Neutralization of Input During Web Page Gene...

PT-2025-43898

Name of the Vulnerable Software and Affected Versions CodeAstro Gym Management System version 1.0 Description A SQL injection issue exists in CodeAstro Gym Management System 1.0. The issue is located in an unknown functionality of the file /admin/actions/check-attendance.php. Manipulation of the ...

WordPress Testimonial Carousel For Elementor plugin <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Testimonial Carousel For Elementor versions = 11.6.2...

NewStart CGSL MAIN 7.02 : python-setuptools Vulnerability (NS-SA-2025-0253)

The remote NewStart CGSL host, running version MAIN 7.02, has python-setuptools packages installed that are affected by a vulnerability: - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex ...

Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update CPU. It is, therefore, affected by: - Vulnerability in Oracle Essbase component: Security and Provisioning Bouncy Castle Java Library. The supported version that is...

CVE-2025-9981 Multiple Stored XSS in QuickCMS

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality sliders-form. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. T...

PT-2025-43527

Name of the Vulnerable Software and Affected Versions FontForge version 20230101 Description A memory leak exists in FontForge through the DlgCreate8 component. The issue involves a memory leak, potentially leading to resource exhaustion. Recommendations At the moment, there is no information abo...

agent-runtime-server (>=0.0.8 <=0.1.0), ai-application-gateway (>=0.1.1 <=0.1.5) +125 more potentially affected by CVE-2025-62611 via aiomysql (>=0.0.11 <=0.2.0)

aiomysql PYPI version =0.0.11, =0.0.8, =0.1.1, =0.0.1, =1.9.0, =2.10.0, =0.1.0, =0.0.2, =1.0.5, =0.0.154, =0.1.0, =0.1.0, =1.1.1, =3.13.4 and more Source cves: CVE-2025-62611 Source advisory: OSV:GHSA-R397-FF8C-WV2G...

CVE-2025-58963

CVE-2025-58963 affects WordPress Medcity theme (versions prior to 1.1.9). The Red Hat and NVD entries, EUVD/ENISA records, and CVE listings consistently describe an unrestricted upload of files with dangerous types in the Medcity plugin/theme, enabling upload of a Web Shell to the web server. Roo...

CVE-2025-49929 WordPress Ultimate Blocks plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows Stored XSS.This issue affects Ultimate Blocks: from n/a through = 3.3.6...

CVE-2025-49916 WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through = 4.2.23...

aiomysql 安全漏洞

aiomysql is a MySQL access library from aio-libs open source. A security vulnerability exists in aiomysql versions prior to 0.3.0, which stems from an unchecked client-side setting that could lead to a malicious server obtaining arbitrary client-side files...

CVE-2025-62480

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Naming Subsystem. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit...

CVE-2025-8053 Insufficient access control vulnerability has been discovered in Opentext Flipper.

Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API without sufficient privileges. This issue affects Flipper: 3.1....

Tomcat-2017-CVEs

It is an exploit module/toolkit targeting Apache Tomcat. The vul...

CVE-2025-36730

Windsurf/Windsurft CVE-2025-36730 is a prompt-injection vulnerability affecting Windsurf/Windsurft version 1.10.7 when operating in Write mode with the SWE-1 model. The issue arises from a crafted file name that becomes appended to the user prompt, causing Windsurf to follow its instructions. Doc...