CVE-2025-25784

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25791

An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file...

YznCMS 安全漏洞

YznCMS is a backend development framework open source by China ken678. A security vulnerability exists in YznCMS v2.0.1, the vulnerability stems from the existence of arbitrary file upload problem, an attacker can upload a well-designed Zip file to execute arbitrary code...

CVE-2025-25790

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25783

CVE-2025-25783 affects Emlog Pro v2.5.3 in the admin/plugin.php component. A crafted Zip file uploaded to the admin area can lead to arbitrary code execution, as described in multiple sources. The CVSSv3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with a base score of 9.8 (CRITICAL). Exploita...

CVE-2025-25784

CVE-2025-25784 affects Jizhicms v2.5.4, with the vulnerable component at c\TemplateController.php. The issue is an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code by uploading a crafted Zip file. The provided metrics indicate a critical impact (CVSS v3.1: 9.8...

CVE-2025-25783

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25784

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file...

Exploit for Protection Mechanism Failure in 7-Zip

7-Zip-CVE-2025-0411-POC CVE-2025-0411 Details "This vuln...

RaspberryMatic 3.73.9.20240130 Remote Code Execution Exploit

RaspberryMatic / OCCU contains a unauthenticated remote code execution vulnerability, caused by multiple issues within the Java based HMIPServer.jar component. The webui allows for Firmware uploads which can be reached through the URL /pages/jpages/system/DeviceFirmware/addFirmware. This allows a...

Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

RaspberryMatic 3.73.9.20240130 Remote Code Execution

RaspberryMatic / OCCU contains a unauthenticated remote code execution vulnerability, caused by multiple issues within the Java based HMIPServer.jar component. The webui allows for Firmware uploads which can be reached through the URL /pages/jpages/system/DeviceFirmware/addFirmware. This allows a...

Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

A malware campaign distributing the XLoader malware has been observed using the DLL side-loading technique by making use of a legitimate application associated with the Eclipse Foundation. "The legitimate application used in the attack, jarsigner, is a file created during the installation of the...

Exploit for Protection Mechanism Failure in 7-Zip

CVE-2025-0411: 7-Zip MoTW Bypass Vulnerability Introductio...

[SECURITY] [DLA 4054-1] tryton-client security update

Debian LTS Advisory DLA-4054-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert February 16, 2025 https://wiki.debian.org/LTS Package : tryton-client Version : 5.0.33-1+deb11u1 CVE ID : not yet available Debian Bug : none Cédric Krier has found that trytond, the...

Debian dla-4054 : tryton-client - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4054 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4054-1 [email protected] https://www.debian.org/lts/security/...

MGASA-2025-0066 Updated python-zipp packages fix security vulnerability

Denial of Service via crafted zip file in jaraco/zipp. CVE-2024-5569...

Updated python-zipp packages fix security vulnerability

Denial of Service via crafted zip file in jaraco/zipp. CVE-2024-5569...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the download function due to improper input validation when processing image references during task exports. . An attacker can access files outside the intended directory structure by creating tasks with path...

Directory Traversal

Overview label-studio is a Label Studio annotation tool Affected versions of this package are vulnerable to Directory Traversal via the download function due to improper input validation when processing image references during task exports. . An attacker can access files outside the intended...