PT-2025-53607

Name of the Vulnerable Software and Affected Versions StreamVault versions prior to 251126 Description StreamVault is a video download integration solution. A Remote Code Execution RCE issue exists in the stream-vault application SpiritApplication. The application does not properly validate...

PT-2025-53586

Name of the Vulnerable Software and Affected Versions IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 Description The software may have inconsistent permissions between the user interface and backend API. This could allow users to access features that appear disabled, potentially leading to...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL or a portion of it directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to th...

PT-2025-53584

Name of the Vulnerable Software and Affected Versions IBM Db2 Intelligence Center versions 1.1.0 through 1.1.2 Description An authenticated user may be able to perform unauthorized actions due to client-side enforcement of server-side security mechanisms. Recommendations Update to a newer version...

WordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP Document Revisions versions = 3.7.2...

WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Funnelforms Free versions = 3.8...

CVE-2025-68577

Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through = 1.1.6...

sui_vulnerable_vault

I will update this project in the future. Now, we have to co...

WordPress GravityForms plugin < 2.9.23.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Marc Montpas in WordPress Plugin Gravity Forms versions 2.9.23.1...

WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Offensive Labs in WordPress Plugin Integration for Contact Form 7 HubSpot versions = 1.4.2...

Exploring the Security Threats of Retriever Backdoors in Retrieval-Augmented Code Generation

Retrieval-Augmented Code Generation RACG is increasingly adopted to enhance Large Language Models for software development, yet its security implications remain dangerously underexplored. This paper conducts the first systematic exploration of a critical and stealthy threat: backdoor attacks...

CVE-2025-48704

Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service...

OnlyOffice Docs Cross-site Scripting Vulnerabilities

ONLYOFFICE Docs is an online office software from ONLYOFFICE, Inc. A cross-site scripting vulnerability exists in versions of ONLYOFFICE Docs prior to 9.2.1, which stems from improper handling of the Font field in the Multi-Level List Settings window, which could lead to a cross-site scripting...

Pexip Infinity security vulnerabilities

Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from the Norwegian company Pexip. The product provides high quality and secure cloud conferencing capabilities. A security vulnerability exists in Pexip Infinity versions 15.0...

OpenOps operating system command injection vulnerability

OpenOps is an automation platform from OpenOps open source. An operating system command injection vulnerability exists in versions of OpenOps prior to 0.6.11, which stems from remote code execution in the Terraform block...

PT-2025-53389

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions 33.0 through 37.0 Description Pexip Infinity signaling has improper input validation, which allows an attacker to trigger a software abort, leading to a denial of service. Recommendations Update to Pexip Infinity versio...

EUVD-2025-205205

Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through = 2.3.1...

Exploit for Deserialization of Untrusted Data in Fortra Goanywhere_Managed_File_Transfer

Structure du projet cve-2023-0669-simulation/ ├── docker-comp...

CVE-2025-68596

Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through = 1.5.11...

CVE-2025-68581

Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through = 1.0.11...