CVE-2024-56324

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56322

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 inclusive can allow GoCD admins to abuse a hidden/unused configuration repository pipelines as code feature to allow XML External Entity XXE injection on the GoCD Server which will be executed when GoCD periodically scans...

CVE-2024-56324 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

CVE-2024-56324 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity XXE injection on the GoCD server. Theoretically, the XXE vulnerability can result in...

PT-2025-1147 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 24.5.0 Description: The issue is related to improper authorization of access to the admin "Configuration XML" UI feature and its associated API in the GoCD system, allowing a malicious insider or existing authenticated...

PT-2025-3096 · Unknown · Wukongcrm-11.0-Java

Name of the Vulnerable Software and Affected Versions: WukongCRM-11.0-JAVA version 11.3.3 Description: An arbitrary file upload vulnerability in the component /adminUser/updateImg allows attackers to execute arbitrary code via uploading a crafted file. This issue enables attackers to potentially...

PT-2025-1509 · WordPress · Mw Wp Form

Name of the Vulnerable Software and Affected Versions: MW WP Form versions n/a through 4.4.5 Description: The issue is related to a Missing Authorization vulnerability in MW WP Form, which allows exploiting incorrectly configured access control security levels. Recommendations: For MW WP Form...

PT-2025-3214 · Webdeclic · Webdeclic Wpmastertoolkit

Name of the Vulnerable Software and Affected Versions: Webdeclic WPMasterToolKit versions 1.13.1 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This allows for Path Traversal in Webdecl...

PT-2025-2519 · Marsian · Marsian I-Amaze

Name of the Vulnerable Software and Affected Versions: Marsian i-amaze versions 1.3.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-1323 · Unknown · Net::Easytcp

Name of the Vulnerable Software and Affected Versions: Net::EasyTCP versions prior to 0.15 Description: The issue concerns the use of Perl's built-in rand function, which is not a strong random number generator, for generating cryptographic keys. This weakness can potentially lead to predictable...

PT-2025-1530

Name of the Vulnerable Software and Affected Versions XLPlugins Finale Lite versions 2.16.0 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations For XLPlugins Finale Li...

PT-2025-2466 · Fs Code · Fs Poster

Name of the Vulnerable Software and Affected Versions: FS Poster versions n/a through 6.5.8 Description: A Cross-Site Request Forgery CSRF issue is present in FS-code FS Poster, allowing Cross Site Request Forgery attacks. Recommendations: For versions n/a through 6.5.8, as a temporary workaround...

PT-2025-3170 · Wordpress Monsters · Preloader

Name of the Vulnerable Software and Affected Versions: Preloader by WordPress Monsters versions 1.2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-3276 · Acronis · Acronis Cyber Protect 16

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 16 Windows versions before build 39169 Description: The issue is related to missing session invalidation after a user is deleted. This means that even after a user's account is deleted, their session remains active. The...

PT-2025-25547 · Assimp +1 · Assimp +1

Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions up to 5.4.3 Description: A critical vulnerability has been found in the Open Asset Import Library Assimp. The issue affects the function Assimp::BVHLoader::ReadNodeChannels in the library...

PT-2025-25550 · Assimp +1 · Assimp +1

Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions up to 5.4.3 Description: A critical issue was found in the Open Asset Import Library Assimp. The read meshes function in the library is affected, leading to a heap-based buffer overflow. This issue ca...

PT-2025-39311

Name of the Vulnerable Software and Affected Versions tar-fs versions prior to 3.1.1 tar-fs versions prior to 2.1.3 tar-fs version 1.16.5 Description tar-fs provides filesystem bindings for tar-stream. Affected versions are susceptible to a symlink validation bypass if the destination directory i...

PT-2024-17925 · Unknown · Phpgurukul Land Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Land Record System version 1.0 Description: A problem has been found in the code of the file /admin/contactus.php. The manipulation of the Page Description argument leads to cross-site scripting. The attack can be initiated remotel...

PT-2024-36701 · Azzaroco · Azzaroco Wp Superbackup

Name of the Vulnerable Software and Affected Versions: Azzaroco WP SuperBackup versions 2.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lead to unauthorized acces...

PT-2024-17920 · Unknown · Phpgurukul Land Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Land Record System version 1.0 Description: A vulnerability was found in the PHPGurukul Land Record System, affecting an unknown function of the file /admin/add-property.php. The manipulation of the Land Subtype argument leads to...