SystemInformation: Operating System Command Injection Vulnerability

systeminformation is an Npm repository for obtaining operating system information by Sebastian Hildebrandt, an individual developer. An OS command injection vulnerability exists in systeminformation versions prior to 5.27.14, which stems from an OS command injection vulnerability in the fsSize...

FreePBX code-related vulnerabilities

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk an IP telephony system via a GUI web-based graphical interface. A code issue vulnerability exists in FreePBX versions prior to 16.0.45 and prior to 17.0.24, which stems from an...

WordPress plugin Stockholm security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Ultimate Auction has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

Grafana Alerting Editors can edit destination of webhooks they did not create

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit...

NETGEAR R6260 Router Arbitrary Command Execution

The vulnerability of NETGEAR R6260 and R6850 Wi-Fi router microprogramming systems is related to insufficient verification of input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

WordPress CC Child Pages plugin <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'child_pages' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'childpages' Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin CC Child Pages versions = 2.0.0...

Cross-site Scripting (XSS)

Overview org.lucee:core is a coer build of Lucee Affected versions of this package are vulnerable to Cross-site Scripting XSS via the admin interface parameters. An attacker can execute arbitrary JavaScript in a victim's browser session by injecting malicious scripts through crafted requests to...

Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components

CVE-2025-55182 also referred to as React2Shell and includes CVE-2025-66478, which was merged into it is a critical pre-authentication remote code execution RCE vulnerability affecting React Server Components, Next.js, and related frameworks. With a CVSS score of 10.0, this vulnerability could all...

WordPress Read More & Accordion plugin <= 3.5.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Read More & Accordion versions = 3.5.5.1...

WordPress Addon Elements for Elementor plugin <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Elementor Addon Elements versions = 1.14.3...

CVE-2025-61145 affecting package libtiff for versions less than 4.6.0-11

CVE-2025-61145 affecting package libtiff for versions less than 4.6.0-11. A patched version of the package is available...

CVE-2025-40341 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40341 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-40322 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40322 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-40323 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40323 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-40204 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40204 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-11670

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled...

Exploit for CVE-2025-55183

React Server Components 취약점 테스트 React Server Components RSC...

Cross-site Scripting (XSS)

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the integration package upload functionality. An attacker can execute arbitrary HTML or script code i...

CVE-2025-14019

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks...