Cisco IOS XR Data Forgery Issue Vulnerability (CNVD-2025-21252)

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR suffers from a data forgery vulnerability that arises from incomplete file validation during installation, which can be exploited by an attacker to cause unsigned...

WordPress WP Import plugin unauthorized access vulnerability

WordPress WP Import plugin is a plugin for batch importing and exporting WordPress data, supports multiple file formats such as CSV, XML, JSON, etc., and can handle posts, pages, comments, users and other data. WordPress WP Import plugin has an unauthorized access vulnerability that stems from a...

WordPress NitroPack plugin unauthorized modification vulnerability

WordPress NitroPack plugin is a speed optimization plugin that is mainly used to improve the loading speed of your website. WordPress NitroPack plugin has an unauthorized modification vulnerability that stems from a lack of capability check in the function nitropacksetcompressionajax, which can b...

WordPress Heateor Login plugin cross-site scripting vulnerability

WordPress Heateor Login plugin is a social login plugin for WordPress, which supports users to realize one-click login and registration function through 23 social networks such as Facebook, Twitter, LinkedIn, Google and so on. A cross-site scripting vulnerability exists in the WordPress Heateor...

Tenda F3 goform/setQoS file buffer overflow vulnerability

Tenda F3 is a 300M wireless router launched on May 15, 2015 by Shenzhen Jixiang Tenda Technology Co. Tenda F3 suffers from a buffer overflow vulnerability that originates from the QosList parameter of the goform/setQoS file failing to properly validate the length size of the input data, which can...

Dell PowerProtect Data Manager OS Command Injection Vulnerability (CNVD-2025-22166)

Dell PowerProtect Data Manager PPDM is a data protection solution from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. An operating system command injection vulnerability exists in Dell PowerProtect Data Manager versions 19.19 and 19.20...

ChanCMS SQL Injection Vulnerability

ChanCMS is a content management system. ChanCMS 3.3.0 and earlier versions suffer from a SQL injection vulnerability, which originates from the lack of validation of the Search parameter key in the app/modules/api/service/Api.js function against external input SQL statements. An attacker can...

Tenda F3 macFilterList Parameter Buffer Overflow Vulnerability

Tenda F3 is a 300M wireless router launched on May 15, 2015 by Shenzhen Jixiang Tenda Technology Co. Tenda F3 suffers from a buffer overflow vulnerability, which stems from the goform/setNAT file macFilterList parameter failing to properly validate the length size of the input data, which can be...

Google Chrome post-release reuse vulnerability (CNVD-2025-22931)

Google Chrome is a web browser developed by Google, known for being fast, secure and personalized, with support for multi-device synchronization and smart tool integration. Google Chrome suffers from a post-release reuse vulnerability that stems from the presence of post-release reuse in...

WordPress AutoCatSet Cross-Site Request Forgery Vulnerability

AutoCatSet is an automatic post categorization plugin for the WordPress platform. A cross-site request forgery vulnerability exists in AutoCatSet 2.1.4 and earlier versions, which stems from the autocatsetajax function not properly implementing a random number validation mechanism. An attacker ca...

Tenda F3 goform/setNAT file portList parameter buffer overflow vulnerability

Tenda F3 is a 300M wireless router launched on May 15, 2015 by Shenzhen Jixiang Tenda Technology Co. Tenda F3 suffers from a buffer overflow vulnerability, which stems from the /goform/setNAT file portList parameter failing to properly validate the length size of the input data, which can be...

WordPress Maspik - Ultimate Spam Protection plugin Cross-Site Request Forgery Vulnerability

WordPress Heateor Maspik - Ultimate Spam Protection plugin is an anti-spam plugin designed specifically for WordPress that protects contact forms, comment areas and signup forms from spam through a variety of technical means. The WordPress Maspik - Ultimate Spam Protection plugin suffers from a...

DELL PowerProtect Data Manager Path Traversal Vulnerability

DELL PowerProtect Data Manager is a data protection solution from Dell Technologies designed for modern multi-cloud environments, supporting data protection and compliance management for physical, virtual and cloud workloads. A path traversal vulnerability exists in DELL PowerProtect Data Manager...

IBM Security Verify Information Queue Denial of Service Vulnerability

IBM Security Verify Information Queue is a microservices architecture integration platform that leverages Kafka technology and a publish/subscribe model to integrate data between IBMSecurity products, acting as a cross-product data exchange hub. A denial of service vulnerability exists in IBM...

WordPress MyBrain Utilities plugin cross-site scripting vulnerability

WordPress MyBrain Utilities plugin is a plugin for enhancing the functionality of your website, mainly for optimizing the performance and user experience. A cross-site scripting vulnerability exists in the WordPress MyBrain Utilities plugin that stems from insufficient input cleanup and output...

Unspecified Vulnerability in Dell PowerProtect Data Manager (CNVD-2025-22168)

Dell PowerProtect Data Manager PPDM is a data protection solution from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. A security vulnerability exists in Dell PowerProtect Data Manager versions 19.19 and 19.20, which can be exploited by...

WordPress Maspik plugin authorization issue vulnerability

WordPress Maspik plugin is an anti-spam plugin for WordPress that is mainly used to protect website contact forms, comment areas and signup forms from spam. WordPress Maspik plugin suffers from an authorization issue vulnerability that stems from a lack of capability check in the function...

Dell PowerProtect Data Manager Operating System Command Injection Vulnerability

Dell PowerProtect Data Manager PPDM is a data protection solution from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. A security vulnerability exists in Dell PowerProtect Data Manager versions 19.19 and 19.20, which can be exploited by...

ChanCMS Server-Side Request Forgery Vulnerability

ChanCMS is a content management system. ChanCMS 3.3.0 version of the existence of server-side request forgery vulnerability, the vulnerability stems from the file / cms/collect/getArticle in the function CollectController parameter taskUrl does not implement a sufficient validation mechanism to...

Unspecified Vulnerability in Dell PowerProtect Data Manager (CNVD-2025-22167)

Dell PowerProtect Data Manager PPDM is a set of data protection solutions from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. A security vulnerability exists in Dell PowerProtect Data Manager versions 19.19 and 19.20, which can be...

Dell PowerProtect Data Manager Elevation of Privilege Vulnerability

Dell PowerProtect Data Manager PPDM is a data protection solution from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. An elevation of privilege vulnerability exists in Dell PowerProtect Data Manager versions 19.19 and 19.20, which stem...

FoxCMS SQL Injection Vulnerability

FoxCMS is a PHP-based content management system that provides web content management and publishing functions. A SQL injection vulnerability exists in FoxCMS 1.24 and earlier versions, which originates from the batchCope function in the /app/admin/controller/Images.php file that does not securely...

WordPress Evenium plugin cross-site scripting vulnerability

The Evenium plugin is an event management tool for the WordPress platform for creating and integrating Evenium meeting management features. Evenium plugin version 1.3.11 and prior versions suffer from a stored XSS vulnerability that stems from insufficient filtering of shortcode user input...

WordPress Responsive Filterable Portfolio plugin Arbitrary File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Responsive Filterable Portfolio plugin has an arbitrary file upload vulnerability that stems from a lack of file type validation in the HdnMediaSelectionimage fiel...

Dell PowerProtect Data Manager Log Information Disclosure Vulnerability

Dell PowerProtect Data Manager PPDM is a data protection solution from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. A log information disclosure vulnerability exists in Dell PowerProtect Data Manager versions 19.19 and 19.20, which...

Tenda F3 goform/setWifi file buffer overflow vulnerability

Tenda F3 is a 300M wireless router launched on May 15, 2015 by Shenzhen Jixiang Tenda Technology Co. Tenda F3 suffers from a buffer overflow vulnerability that originates from the goform/setWifi file failing to properly validate the length size of the input data, which can be exploited by an...

Tenda F3 goform/setParentControl file buffer overflow vulnerability

Tenda F3 is a 300M wireless router launched on May 15, 2015 by Shenzhen Jixiang Tenda Technology Co. Tenda F3 suffers from a buffer overflow vulnerability, which stems from the goform/setParentControl file failing to properly validate the length size of input data, which can be exploited by an...

WordPress Certifica Cross-Site Scripting Vulnerability

Certifica is a certificate generation and management plugin for the WordPress platform. A stored XSS vulnerability exists in Certifica 3.1 and earlier versions, which stems from insufficient input filtering and output escaping of evento parameters. The vulnerability can be exploited to inject a...

WordPress Duplicate Page and Post plugin SQL Injection Vulnerability

WordPress Duplicate Page and Post plugin is a plugin for quickly duplicating pages or posts, supporting one-click cloning of existing content and saving it to draft, private or public status, for users who need to batch process website content. WordPress Duplicate Page and Post plugin suffers fro...

Cisco IOS XR Resource Management Error Vulnerability (CNVD-2025-21253)

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR suffers from a Resource Management Error vulnerability that arises from uncontrolled resource consumption by an application, which can be exploited by an attacker to...

IBM Security Verify Information Queue Elevation of Privilege Vulnerability

IBM Security Verify Information Queue is a microservices architecture integration platform that leverages Kafka technology and a publish/subscribe model to integrate data between IBMSecurity products, acting as a cross-product data exchange hub. An elevation of privilege vulnerability exists in I...

WordPress Testimonial Plugin SQL Injection Vulnerability

WordPress Testimonial Plugin is a plugin for displaying customer feedback, testimonials or user reviews in your website, mainly for enhancing website trust and social proof. WordPress Testimonial Plugin suffers from a SQL injection vulnerability that stems from insufficient cleaning and escaping ...

Cisco IOS XR Access Control Error Vulnerability (CNVD-2025-21251)

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR suffers from an Access Control Error vulnerability that stems from improper access control of the management interface ACL, which can be exploited by an attacker to cau...

UTT 1200GW Buffer Overflow Vulnerability

The UTT 1200GW is an enterprise-grade wireless router from Atech Technology UTT designed to meet the networking needs of small to medium-sized businesses or large space office environments. The UTT 1200GW suffers from a buffer overflow vulnerability that originates from the sub4B48F8 function in...

Tenda G3 formModifyPppAuthWhiteMac function stack buffer overflow vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. A stack buffer overflow vulnerability exists in the Tenda G3 formModifyPppAuthWhiteMac function, which can be exploited by an attacker to cause a denial of service DoS via a specially crafted request...

Tenda G3 formDelDhcpRule function buffer overflow vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. A buffer overflow vulnerability exists in Tenda G3 v3.0brV15.11.0.17, which originates from the delDhcpIndex parameter in the formDelDhcpRule function that fails to properly validate the length of the input data, and can be exploited by an attacker t...

Tenda G3 dns_forward_rule_store function buffer overflow vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. A buffer overflow vulnerability exists in Tenda G3 v3.0brV15.11.0.17, which originates from the failure of the rules parameter in the dnsforwardrulestore function to correctly validate the length of the input data, and can be exploited by an attacker...

Tenda G3 addDhcpRule function buffer overflow vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. A buffer overflow vulnerability exists in Tenda G3 v3.0brV15.11.0.17, which is caused by the dhcpIndex parameter in the addDhcpRule function failing to correctly validate the length and size of the input data, and can be exploited by an attacker to...

SAP Supplier Relationship Management Cross-Site Scripting Vulnerability (CNVD-2025-21206)

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functions such as invoicing. A cross-site scripting vulnerability exists in SAP...

Rockwell Automation ThinManager Server-Side Request Forgery Vulnerability

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers simultaneously. A server-side request forgery vulnerability exists in Rockwell Automation ThinManager, which stems from...

Microsoft Excel Code Execution Vulnerability (CNVD-2025-21398)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Microsoft Excel Code Execution Vulnerability (CNVD-2025-21394)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2025-21393)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel. An attacker could exploit this vulnerability to obtain sensitive information...

Microsoft Excel Code Execution Vulnerability (CNVD-2025-21392)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. Microsoft Excel Code Execution Vulnerability, the vulnerability is caused due to failure to free memory on the heap. An attacker can exploit this vulnerability to execute arbitrary code on the system...

Adobe Commerce Security Bypass Vulnerability (CNVD-2025-21417)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce that can be exploited by an attacker to bypass security restrictions...

WordPress AI ChatBot for WordPress plugin cross-site scripting vulnerability

WordPress AI ChatBot for WordPress plugin is an Artificial Intelligence ChatBot plugin designed for WordPress websites, which is mainly used to provide 24/7 automated customer service support, generate leads, collect user information and other features. The WordPress AI ChatBot for WordPress plug...

Tenda G3 guestWifiRuleRefresh function buffer overflow vulnerability

Tenda G3 is a micro-enterprise all-in-one gateway from Tenda, designed for small and medium-sized businesses to provide an integrated network solution. Tenda G3 suffers from a buffer overflow vulnerability, which stems from the failure of the gstUp parameter in the guestWifiRuleRefresh function t...

Small CRM /profile.php File SQL Injection Vulnerability

Small CRM is a customer relationship management system. Small CRM suffers from an SQL injection vulnerability that stems from the /profile.php file not having a secure filter for the Name parameter. No details of the vulnerability are available at this time...

Microsoft PowerPoint Code Execution Vulnerability (CNVD-2025-26723)

Microsoft PowerPoint is a document presentation tool in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft PowerPoint, which can be exploited by an attacker to execute arbitrary code on a system...

Microsoft Office Code Execution Vulnerability (CNVD-2025-26728)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to...