CVE-2025-26611 SQL Injection endpoint 'remover_produto.php' parameter 'id_produto' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, removerproduto.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized...

CVE-2024-13535

The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-setup.php file being publicly accessible with 'displayerrors' set to true. This makes it possible for unauthenticated attackers to retrieve...

IBM Aspera Shares Input Validation Error Vulnerability

IBM Aspera Shares is a Web application from International Business Machines IBM. An input validation error vulnerability exists in IBM Aspera Shares, which stems from improper validation of the "Client-IP" header, and can be exploited by an attacker to spoof its IP address written to a log file...

IBM Aspera Shares Cross-Site Scripting Vulnerability (CNVD-2025-04172)

IBM Aspera Shares is a Web application from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2025-03519)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...

[SECURITY] Fedora 41 Update: nginx-mod-naxsi-1.6-9.fc41

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

[SECURITY] Fedora 40 Update: nginx-mod-naxsi-1.6-9.fc40

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

CVE-2025-24688

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through = 1.8.20.0...

CVE-2024-31843

An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System...

CVE-2024-31845

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...

CVE-2024-31840

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edit the configuration of the email server. Once the user access the edit function, the web application fills the edit form with the current...

CVE-2025-24897

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

91jin (>=0.1.7, <=0.1.8), @aftonbladet/roc-package-web-app-gaea (>=0.1.0, <=0.4.1) +147 more potentially affected by CVE-2025-25200 via koa (>=1.0.0, <=1.7.0)

koa NPM version =1.0.0, =0.1.7, =0.1.0, =2.4.1, =0.0.2, =0.0.1, =0.1.0, =0.4.11, =0.1.0, =0.0.2, =1.2.1 and more Source cves: CVE-2025-25200 Source advisory: OSV:GHSA-593F-38F6-JP5M...

CVE-2025-25184 Possible Log Injection in Rack::CommonLogger

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

WordPress plugin AForms Eats 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2025-24897

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24897

Misskey CSRF vulnerability (CVE-2025-24897) affects Misskey versions 12.109.0 up to but not including 2025.2.0-alpha.0, due to CSRF protection gaps and insecure authentication cookie attributes in Bull dashboard. Some bull-board APIs can be driven into CSRF attacks, enabling potential manipulatio...

CVE-2025-24897 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24897 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24897 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...