summary: A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: ruoyi-vue-pro

vendor: zhijiantianya

status: affected

ecosystem: software/application

metric_type: Secondary

severity: medium

part: a

vendor: iocoder

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


default_status: unaffected

product: PI Web API

vendor: AVEVA

version_type: custom

ecosystem: javascript/npm

status: Deferred

summary: A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.

title: Aveva Pi Web Api security vulnerability


product: Xperience

vendor: Kentico

business_risk: Critical remote authentication bypass in Kentico Xperience can allow unauthenticated attackers to control administrative objects. The issue is listed in CISA's Known Exploited Vulnerabilities Catalog, so remediation should be prioritized.

claim: The affected product is Kentico Xperience, specifically the staging functionality.

claim: Kentico Xperience versions 13.0.172 and lower are affected.

claim: The vulnerability affects instances with staging enabled and username-and-password authentication; the staging Sync Server endpoint is the relevant attack surface.

kind: exposure

claim: Kentico identifies version 13.0.173 as the fixed version for CVE-2025-2746.

claim: Kentico recommends installing the latest hotfix; temporary mitigations include disabling staging, using X.509 authentication, and limiting which external services can access the staging Sync Server endpoint.

kind: remediation

claim: A safe verification approach is to compare the deployed version with Kentico's affected/fixed version listing and confirm the documented staging mitigation is in place, without attempting exploitation.

kind: verification

claim: CISA lists CVE-2025-2746 in the Known Exploited Vulnerabilities Catalog and records active exploitation in the NVD change history.

exposure_conditions: The staging service uses username-and-password authentication; Kentico states that X.509 authentication is not vulnerable to this issue.

exposure_conditions: The staging Sync Server endpoint is reachable by an attacker or insufficiently restricted.

remediation_steps: Upgrade or hotfix Kentico Xperience to version 13.0.173 or later.

remediation_steps: If immediate patching is not possible, disable staging on affected servers.

remediation_steps: Alternatively, use X.509 authentication for staging and restrict access to the staging Sync Server endpoint to only required external services.

remediation_steps: Treat exposed instances as potentially compromised and review administrative objects and relevant security logs using the organization's incident-response process.

status: complete

uncertainty: The authoritative vendor page identifies the affected staging configuration and fixed version but does not provide a non-invasive product-specific command or endpoint for automated version verification.

uncertainty: The available sources do not establish whether a particular deployment was exploited or provide a complete compromise-assessment procedure.

uncertainty: The exact latest hotfix beyond version 13.0.173 is not required to remediate this CVE but should be selected according to the deployment's supported upgrade path.

verification_steps: Confirm the deployed Kentico Xperience version is 13.0.173 or later, based on Kentico's affected and fixed-version listing.

verification_steps: Confirm staging is disabled, or confirm that staging uses X.509 authentication rather than username-and-password authentication.

verification_steps: Confirm access to the staging Sync Server endpoint is restricted to authorized services; do not perform exploit attempts or unauthenticated bypass testing in production.

verification_steps: Because the CVE is in CISA's KEV catalog, review available security telemetry for suspicious staging requests and unexpected administrative-object changes.

known_ransomware_campaign_use: Unknown

product: Xperience CMS

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Kentico

vulnerability_name: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

severity: critical

product: xperience

vendor: kentico

summary: An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.


author: Codex

content_markdown:
Kentico Xperience content staging has an authorization-bypass flaw.
This ID has **no GHSA**. NVD is **Analyzed**. Live NVD CPE last-affects
**including 13.0.178**. Kentico names **13.0.177 and lower** as
affected and **13.0.178** as fixed, and recommends the latest hotfix.
**13.0.178 is not an NVD exclude floor.** This page stays stable
because Kentico names a single hotfix, with the NVD including-
**13.0.178** split recorded.

Do not invent a later **13.0.179** floor. Do not prove exposure with
crafted staging requests.

## When to use it

- Inventory shows Kentico Xperience **13.0.177 or lower** (vendor
  affected window). NVD still last-affects **including 13.0.178**,
  but that listing is not the vendor-affected pin.

## Inputs

- Xperience version and https://devnet.kentico.com/download/hotfixes.

## Affected versions

- **Vulnerable / NVD CPE:** Xperience last-affects **including
  13.0.178**. Live NVD has one CPE row.
- **Fixed / NVD CPE:** none. There is no GHAD first_patched and
  **no exclude**.
- **Fixed / vendor prose:** Kentico names **13.0.178**, or a later
  Kentico-named hotfix.
- **Do not invent:** treat leftover **13.0.178** as an NVD exclude,
  or invent **13.0.179**.
- **CISA KEV:** yes.

## Remediation strategy

- Upgrade every **13.0.177-or-lower** instance to vendor **13.0.178**
  or the current Kentico hotfix. That is the vendor-named stop, not
  an NVD exclude.
- Record that NVD last-affects **including 13.0.178**, so **13.0.178**
  is vendor-fixed and still NVD-listed. Prefer a later Kentico hotfix
  when one exists if the goal is to leave the NVD including row.
- Recheck the Kentico hotfix page and NVD before treating **13.0.178**
  as NVD-clean.
- Do not roll back into vendor-affected **13.0.177** or lower.

## Verification

- Xperience reports vendor **13.0.178** or a later named hotfix for
  the vendor-affected **13.0.177-or-lower** window.
- Operator notes cite that NVD last-affects including **13.0.178**
  and that the vendor hotfix is not an NVD exclude. Do not treat
  **13.0.178** as NVD-clean.
- Tests never send crafted staging requests.

## Rollback and recovery

Prefer forward recovery to another Kentico-named 13.0 hotfix. If an
operational rollback restores **13.0.177** or lower, isolate the
staging endpoint. A rollback that lands on **13.0.178** stays
vendor-named-fixed and still NVD-listed.

## Output contract

- Change request upgrading vendor-affected Xperience to **13.0.178**
  or later after the NVD including-**13.0.178** split.
- `TRIAGE.md` when this repository does not own Xperience.

## Related recipes

- [Search the CVE Database for CVE-2025-2747](/cve-database/?q=CVE-2025-2747#cve-catalog)

## References

- Kentico hotfixes: <https://devnet.kentico.com/download/hotfixes>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2025-2747>
- CISA KEV: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2747>

description: CVE-2025-2747 is CISA KEV Kentico leftover. NVD CPE last-affects including 13.0.178. Vendor names 13.0.178. 13.0.178 is not an NVD exclude.

maturity: stable

title: CVE-2025-2747: Kentico Xperience staging auth bypass

quality: curated

recipe_kind: markdown-override

summary: An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.

title: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability


default_status: affected

metric_type: Primary

status: Modified

summary: The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

title: Kentico Xperience security vulnerability


product: Kentico Xperience

vulnerability_name: Kentico Xperience Path Traversal Vulnerability

severity: high

summary: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.


product: Assimp

vendor: Open Asset Import Library

product: assimp

vendor: assimp

summary: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


default_status: unknown

product: GStreamer

vendor: GStreamer

product: gstreamer

vendor: gstreamer

summary: GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.


product: GIMP

vendor: GIMP

product: gimp

vendor: gimp

summary: GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.


summary: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.


vendor: CarlinKit

product: autokit

vendor: carlinkit

summary: CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948.


summary: CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356.


summary: CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of update packages provided to update.cgi. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24355.


summary: CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the wireless hotspot. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-24349.


ecosystem: operating-system

part: o

summary: 70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability. The specific flaw exists within the default configuration of user accounts. The configuration contains default password. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the root. Was ZDI-CAN-24996.


product: NG Firewall

vendor: Arista

vendor: arista

summary: Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the processing of the User-Agent HTTP header. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24407.


product: NetDrive

vendor: Bdrive

product: netdrive

vendor: bdrive

summary: Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25041.


summary: Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25295.


product: Multiple Routers

vendor: BEC Technologies

vendor: bectechnologies

summary: BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from storing credentials in a recoverable format. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25986.


summary: BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25894.


summary: BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within /cgi-bin/tools_usermanage.asp. The issue results from transmitting a list of users and their credentials to be handled on the client side. An attacker can leverage this vulnerability to disclose transported credentials, leading to further compromise. Was ZDI-CAN-25895.


summary: BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BEC Technologies Multiple Routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the management interface, which listens on TCP port 22 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-25903.


product: SysAid On-Prem

vendor: SysAid

business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The authoritative sources establish the affected range and the vendor-fixed release, but do not provide a vendor-specific mitigation for systems that cannot yet be upgraded.

uncertainty: The returned sources do not establish a precise safe endpoint-level verification procedure or whether every release newer than 24.4.60 b16 is supported; confirm later-version applicability with SysAid release documentation before relying on it.

uncertainty: The evidence is specific to SysAid On-Prem and does not establish exposure for cloud-hosted SysAid services.

uncertainty: The model did not return a fully sourced exposure, remediation, and verification set; consult the linked NVD and vendor sources before acting.

archetype: xxe

vendor_project: SysAid

vulnerability_name: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

product: sysaid

vendor: sysaid

summary: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.


business_risk: Critical. SysAid On-Prem versions through 23.3.40 are affected by an unauthenticated XXE vulnerability in Server URL processing. Successful exploitation may provide file-read capability and enable administrator account takeover. CISA lists the CVE in its Known Exploited Vulnerabilities catalog, so remediation should be prioritized.

claim: NVD identifies SysAid On-Prem versions less than or equal to 23.3.40 as affected.

claim: The vulnerability is described as an unauthenticated XXE issue in Server URL processing, enabling file-read primitives and administrator account takeover.

exposure_conditions: SysAid On-Prem is deployed with an affected version, including versions <= 23.3.40.

exposure_conditions: The vulnerable Server URL processing functionality is reachable by an unauthenticated remote attacker; SysAid release notes identify the affected component as mdm/serverurl.

exposure_conditions: Exposure is higher when the SysAid On-Prem service is reachable from untrusted or internet-based networks.

remediation_steps: Upgrade SysAid On-Prem to a vendor release containing the CVE-2025-2776 fix. SysAid release notes identify version 24.4.60 b16 as containing the XXE vulnerability fix.

remediation_steps: Prioritize remediation in accordance with CISA KEV guidance and the vendor’s update instructions.

remediation_steps: If immediate upgrading is unavailable, restrict network access to the SysAid On-Prem service to trusted administrative networks and apply only vendor-provided mitigations. Do not rely on network restriction as a substitute for patching.

uncertainty: The authoritative sources establish that versions <= 23.3.40 are affected and that SysAid release 24.4.60 b16 includes the CVE-2025-2776 fix, but they do not provide a complete vendor-supported mitigation procedure for systems that cannot be upgraded.

uncertainty: No authoritative source reviewed here establishes a specific configuration-based workaround or a detailed passive detection method for the vulnerable endpoint.

uncertainty: The exact installed version and network exposure of the affected deployment are unknown.

verification_steps: Confirm the installed SysAid On-Prem release is 24.4.60 b16 or a later vendor release, using the product’s administrative version information or approved software inventory.

verification_steps: Confirm that the deployed release documentation or change record identifies CVE-2025-2776/SYSAID-11224 as remediated.

verification_steps: Verify that external access to the SysAid On-Prem administrative service is limited to intended trusted networks. Do not send crafted XML or exploit-test requests to production systems.

summary: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

title: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability


summary: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

title: Sysaid security vulnerability


vendor: htplugins

version_type: semver

ecosystem: php/wordpress

summary: The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.

title: Htplugins Insert Headers And Footers Code – Ht Script security vulnerability


product: Woffice Core

vendor: WofficeIO

product: woffice

vendor: xtendify

summary: The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Xtendify Woffice security vulnerability


product: Mobile VPN with SSL Client

vendor: WatchGuard

ecosystem: windows/system

summary: The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.

title: Watchguard Mobile Vpn With Ssl Client security vulnerability


product: SSO Terminal Services Agent

summary: The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.

title: Watchguard Sso Terminal Services Agent security vulnerability


product: Chrome

vendor: Google

archetype: generic

ecosystem: browser

product: Chromium Mojo

vendor_project: Google

vulnerability_name: Google Chromium Mojo Sandbox Escape Vulnerability

product: chrome

vendor: google

summary: Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)


product: Red Hat Enterprise Linux 10

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 8.2 Advanced Update Support

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.8 Extended Update Support

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.2 Extended Update Support

description: CVE-2025-2784 is a heap over-read in libsoup skip_insight_whitespace content sniffing. GHSA-5qxx-2mqf-3v7g names no version range and no floor.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2025-2784: libsoup Content-Sniff Over-Read, No Named Floor

product: libsoup

vendor: gnome

vendor: redhat

recipe_kind: markdown-draft

summary: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

title: A flaw was found in libsoup


product: Red Hat OpenShift distributed tracing 3.5.3

product: Red Hat OpenShift distributed tracing 3

part: redhat

summary: A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.

title: Red Hat Red Hat Openshift Distributed Tracing 3.5.3 security vulnerability


product: KNIME Business Hub

vendor: KNIME

vendor: knime

summary: KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower. Besides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub: * 1.13.3 or above * 1.12.4 or above * 1.11.4 or above * 1.10.4 or above *

title: Knime Business Hub security vulnerability


product: MultiVendorX – WooCommerce Multivendor Marketplace Solutions

vendor: wcmp

product: multivendorx

vendor: multivendorx

summary: The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.

title: Multivendorx security vulnerability


product: Sterling B2B Integrator

vendor: IBM

product: Sterling File Gateway

vendor: ibm

summary: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

title: Ibm Sterling B2B Integrator security vulnerability


product: Xperience

vendor: Kentico

product: xperience

vendor: kentico

summary: An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.


product: EOS

vendor: Arista Networks

summary: On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be forwarded due to this vulnerability. Note: this issue does not affect VXLANSec or MACSec encryption functionality.

title: Arista Networks Eos security vulnerability


product: Woffice Core

vendor: WofficeIO

product: woffice

summary: The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_handle_user_approval_actions' function. This makes it possible for unauthenticated attackers to approve registration for any user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


product: Woffice CRM

vendor: XTENDIFY

vendor: xtendify

summary: The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.


vendor: wpeventmanager

vendor: wp-eventmanager

summary: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Wp-Eventmanager Wp Event Manager security vulnerability


summary: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


product: Create custom forms for WordPress with a smart form plugin for smart businesses – Form builder for WordPress

vendor: dorinabc

summary: The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

title: Dorinabc Create Custom Forms For Wordpress With A Smart Form Plugin For… security vulnerability


product: LayoutBoxx

vendor: layoutboxx

summary: The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.


product: So-Called Air Quotes

vendor: davemacd

summary: The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.


product: tagDiv Composer

vendor: tagDiv

summary: The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Tagdiv Tagdiv Composer security vulnerability


product: ORDER POST

summary: The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.


vendor: tagdiv

summary: The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.


vendor: stylemix

vendor: stylemixthemes

summary: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server which may make remote code execution possible.

title: Stylemixthemes Motors - Car Dealer, Classifieds & Listing security vulnerability


summary: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in all versions up to, and including, 1.4.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


product: azurecurve Shortcodes in Comments

vendor: azurecurve

summary: The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

title: Azurecurve Azurecurve Shortcodes In Comments security vulnerability


product: Draeger ICMHelper

vendor: Draeger

summary: A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key.


product: GL-A1300 Slate Plus

product: GL-AR300M16 Shadow

product: GL-AR300M Shadow

product: GL-AR750 Creta

product: GL-AR750S-EXT Slate

product: GL-AX1800 Flint

product: GL-AXT1800 Slate AX

product: GL-B1300 Convexa-B

product: GL-B3000 Marble

product: GL-BE3600 Slate 7

product: GL-E750V2 Mudi

summary: A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.

title: Gl.Inet Gl-A1300 Slate Plus security vulnerability


product: Ticket Sales Automation

vendor: Mydata Informatics

vendor: mydata

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection. This issue affects Ticket Sales Automation: before 03.04.2025 (DD.MM.YYYY).

title: Mydata Ticket Sales Automation security vulnerability


product: AXL F BK PN TPS

vendor: Phoenix Contact

product: AXL F BK PN TPS XC

product: AXL F BK PN (discontinued)

product: AXL F BK PN XC (discontinued)

product: AXL F BK SAS (discontinued)

product: AXL F BK ETH

product: AXL F BK ETH XC

product: AXL F BK EIP

product: AXL F BK EIP EF

product: AXL F BK EIP XC

product: IL PN BK-PAC

product: IL ETH BK-PAC

summary: An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80.


vendor: LDS

summary: Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.

title: Lds Crypt::Cbc security vulnerability


product: Administrator Z

summary: The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.

title: Quyle91 Administrator Z security vulnerability


product: Page View Count

summary: The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.

title: A3Rev Page View Count security vulnerability


product: firefox

vendor: mozilla

product: thunderbird

summary: Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

title: Mozilla Firefox security vulnerability


product: Smart Connect Android Application

vendor: Motorola

severity: low

summary: A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could allow a nearby attacker within the Bluetooth interaction range to intercept files when transferred to a device not paired in Smart Connect.

title: Motorola Smart Connect Android Application security vulnerability


product: GT-SoftControl

vendor: Bizerba SE & Co. KG

summary: There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.

title: Bizerba Se & Co. Kg Gt-Softcontrol security vulnerability


product: Product family GLx and CWx

summary: An authenticated attacker can compromise the availability of the device via the network


product: Search Exclude

vendor: quadlayers

summary: The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.

title: Quadlayers Search Exclude security vulnerability


product: Operational Decision Manager

vendor: IBM

vendor: ibm

summary: IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

title: Ibm Operational Decision Manager security vulnerability


product: Sterling File Gateway

summary: IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system.

title: Ibm Sterling File Gateway security vulnerability


product: langchain-ai/langchain

vendor: langchain-ai

version: unspecified

archetype: ssrf

product: langchain

vendor: langchain

summary: A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result, an attacker could exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. This issue has been fixed in version 0.0.28.

title: Langchain security vulnerability


product: Arena®

vendor: Rockwell Automation

version: 16.20.08 and earlier

product: arena

vendor: rockwellautomation

summary: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

title: Rockwellautomation Arena security vulnerability


summary: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

title: Mozilla Thunderbird security vulnerability


product: tushuguanlixitong 图书管理系统

vendor: mingyuefusu 明月复苏

vendor: mingyuefusu

summary: A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

title: Mingyuefusu Library Management System security vulnerability


summary: A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: OneBlog

vendor: zhangyd-c

product: oneblog

vendor: zhyd

summary: A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


ecosystem: java/maven

summary: A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


vendor: metagauss

summary: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Metagauss Registrationmagic – Custom Registration Forms, User Registrat… security vulnerability


product: Gecko OS

vendor: Silicon Labs

vendor: silabs

summary: Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23245.


summary: Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.


product: WP Import Export Lite

vendor: vjinfotech

summary: The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Vjinfotech Wp Import Export Lite security vulnerability


product: DAP to Autoresponders Email Syncing

vendor: bhuvnesh

summary: The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

title: Bhuvnesh Dap To Autoresponders Email Syncing security vulnerability


product: Cart66 Cloud :: WordPress Ecommerce The Easy Way

summary: The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

title: Reality66 Cart66 Cloud :: Wordpress Ecommerce The Easy Way security vulnerability


product: Red Hat OpenShift distributed tracing 3.5.3

vendor: Red Hat

product: Red Hat OpenShift distributed tracing 3

summary: A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

title: A flaw was found in the Tempo Operator


product: observability-operator

vendor: rhobs

product: Cluster Observability Operator 1.3.0

summary: A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.


product: Online Eyewear Shop

vendor: SourceCodester

summary: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects the function registration of the file /oews/classes/Users.php?f=registration of the component Registration. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Gym Management System

vendor: Codezips

vendor: codezips

summary: A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown processing of the file /dashboard/admin/over_month.php. The manipulation of the argument mm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Synology Mail Server

vendor: Synology

vendor: synology

summary: A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.

title: Synology Mail Server security vulnerability


product: UPX

product: upx

vendor: upx

summary: A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.


product: GL-A1300 Slate Plus

product: GL-AR300M16 Shadow

product: GL-AR300M Shadow

product: GL-AR750 Creta

product: GL-AR750S-EXT Slate

product: GL-AX1800 Flint

product: GL-AXT1800 Slate AX

product: GL-B1300 Convexa-B

product: GL-B3000 Marble

product: GL-BE3600 Slate 7

product: GL-E750V2 Mudi

summary: A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been rated as problematic. This issue affects some unknown processing of the component Download Interface. The manipulation leads to improper authorization. It is recommended to upgrade the affected component.

title: Gl.Inet Gl-A1300 Slate Plus security vulnerability


summary: A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. Affected is an unknown function of the file plugins.so of the component RPC Handler. The manipulation leads to buffer overflow. It is recommended to upgrade the affected component.


product: Food Ordering Management System

summary: A vulnerability has been found in SourceCodester Food Ordering Management System up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menus/view_menu.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition.


product: Payroll Management System

vendor: code-projects

vendor: fabian

summary: A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file update_employee.php. The manipulation of the argument emp_type leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


product: eladmin

vendor: elunez

vendor: eladmin

summary: A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely.


product: firefox

vendor: mozilla

summary: Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.


product: saTECH BCU

vendor: Arteche

vendor: arteche

summary: Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.


summary: An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.

title: Arteche Satech Bcu Firmware security vulnerability


summary: SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website.


summary: SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.


summary: SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.


summary: Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.


summary: SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).


summary: SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.


product: LibreOffice

vendor: The Document Foundation

version_type: 24.8 series

version_type: 25.2 series

product: libreoffice

vendor: libreoffice

summary: Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.


summary: An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.

title: Gitlab security vulnerability


product: Clinic Queuing System

vendor: Clinic Queuing System

summary: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.


summary: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the id parameter in /manage_user.php.


summary: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php.


product: QuadMenu – Mega Menu

vendor: quadlayers

summary: The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Quadlayers Quadmenu – Mega Menu security vulnerability


vendor: specialk

summary: The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Specialk User Submitted Posts – Enable Users To Submit Posts From The F… security vulnerability


product: Modicon Controllers M241 / M251

vendor: Schneider Electric

version: Versions prior to v5.3.12.48

product: Modicon Controllers M258 / LMC058

version: All versions

summary: CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.

title: Schneider Electric Modicon Controllers M241 / M251 security vulnerability


product: MelaPress Login Security Premium

vendor: melapress

product: MelaPress Login Security

summary: The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user.

title: Melapress Melapress Login Security security vulnerability


product: Red Hat Ansible Automation Platform 2.4 for RHEL 8

vendor: Red Hat

product: Red Hat Ansible Automation Platform 2.4 for RHEL 9

product: Red Hat Ansible Automation Platform 2.5 for RHEL 8

product: Red Hat Ansible Automation Platform 2.5 for RHEL 9

summary: A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.


product: CMS

vendor: Kentico

summary: A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component.


product: Valhall GPU Kernel Driver

vendor: Arm Ltd

version_type: patch

vendor: arm

summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to expose sensitive data.This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.

title: Arm 5Th Gen Gpu Architecture Kernel Driver security vulnerability


product: Yame | Link In Bio

vendor: yame

summary: The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

title: Yame Yame | Link In Bio security vulnerability


product: Developer Toolbar

summary: The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

title: Bap22 Developer Toolbar security vulnerability


product: GreenPay(tm) by Green.Money

vendor: greenmoney

summary: The GreenPay(tm) by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

title: Greenmoney Greenpay(Tm) By Green.Money security vulnerability


vendor: zealopensource

summary: The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

title: Zealopensource Accept Sagepay Payments Using Contact Form 7 security vulnerability


vendor: Trusted Computing Group

product: SIMATIC CN 4100

vendor: Siemens

product: SIMATIC Field PG M5

product: SIMATIC Field PG M6

product: SIMATIC IPC BX-32A

product: SIMATIC IPC BX-39A

product: SIMATIC IPC BX-56A

product: SIMATIC IPC BX-59A

product: SIMATIC IPC MD-57A

product: SIMATIC IPC PX-32A

product: SIMATIC IPC PX-39A

product: SIMATIC IPC PX-39A PRO

summary: TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0

title: Trusted Computing Group Tpm2.0 security vulnerability


product: tough

vendor: AWS

vendor: amazon

summary: Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

title: Amazon Tough security vulnerability


summary: Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

title: Amazon Tough security vulnerability


summary: During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.


summary: During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.


product: Link Library

vendor: jackdewey

summary: The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Jackdewey Link Library security vulnerability


product: tagDiv Opt-In Builder

vendor: TagDiv

summary: The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Tagdiv Tagdiv Opt-In Builder security vulnerability


product: Real Estate 7 WordPress

vendor: contempoinc

summary: The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled.

title: Contempoinc Real Estate 7 Wordpress security vulnerability


vendor: smub

vendor: aioseo

summary: The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Aioseo All In One Seo security vulnerability


product: Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem

vendor: jegstudio

product: gutenverse

summary: The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's countdown Block in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Jegstudio Gutenverse security vulnerability


vendor: Unitree

vendor: unitree

summary: The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.

title: Unitree Go1 Firmware security vulnerability


product: Cloud Pak System

vendor: IBM

vendor: ibm

summary: IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.


product: Planning Analytics Local

summary: IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


product: Maximo Application Suite

summary: IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a security configuration vulnerability in Role-Based Access Control (RBAC) configurations.

title: Ibm Maximo Application Suite security vulnerability


product: Semeru Runtime

summary: IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation.

title: Ibm Semeru Runtime security vulnerability


vendor: Hitachi

description: CVE-2025-2902 is improper authorization in the Hitachi VSP maintenance utility. GHSA-3mc2-p59g-jpp4 names DKCMAIN and GUM floors. Do not invent later DKCMAIN tags.

title: CVE-2025-2902: Hitachi VSP Maintenance Authz, Named DKCMAIN Floors

summary: Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ver. 88-08-20/00.


product: Delphix

vendor: Perforce

summary: An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.

title: Perforce Delphix security vulnerability


product: WSO2 API Manager

product: WSO2 Enterprise Integrator

status: unknown

product: WSO2 Enterprise Service Bus

product: WSO2 Micro integrator

product: WSO2 Open Banking AM

summary: Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.

title: Wso2 Api Manager security vulnerability


product: Contempo Real Estate Core

summary: The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Contempoinc Contempo Real Estate Core security vulnerability


product: Order Delivery Date

vendor: Unknown

vendor: tychesoftwares

summary: The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.


product: MeetMe

vendor: Fermax

summary: The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to some important assets via configuration files.

title: Fermax Meetme security vulnerability


product: DuoxMe iOS application

summary: The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.

title: Fermax Duoxme Ios Application security vulnerability


summary: User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages.

title: Fermax Meetme security vulnerability


summary: Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.

title: Fermax Meetme security vulnerability


vendor: hdfgroup

summary: A vulnerability was found in HDF5 up to 1.14.6. It has been declared as problematic. Affected by this vulnerability is the function H5O_msg_flush of the file src/H5Omessage.c. The manipulation of the argument oh leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in HDF5 up to 1.14.6. It has been rated as critical. Affected by this issue is the function H5FL__blk_gc_list of the file src/H5FL.c. The manipulation of the argument H5FL_blk_head_t leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as problematic was found in HDF5 up to 1.14.6. This vulnerability affects the function H5F__accum_free of the file src/H5Faccum.c. The manipulation of the argument overlap_size leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.


product: Call Center System

vendor: Aishida

summary: A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This issue affects some unknown processing of the file /doscall/weixin/open/amr2mp3. The manipulation of the argument File leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: ChestnutCMS

product: chestnutcms

summary: A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


product: Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor

vendor: ultimateblocks

vendor: dotcamp

summary: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Dotcamp Ultimate Blocks security vulnerability


vendor: Netis

vendor: netis-systems

summary: A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl_deserialize of the file src/H5HLcache.c. The manipulation of the argument free_block leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache_chk_serialize of the file src/H5Ocache.c. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.


product: CDG

vendor: ESAFENET

product: cdg

vendor: esafenet

summary: A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. Affected is an unknown function of the file /parameter/getFileTypeList.jsp. The manipulation of the argument typename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: Genetec Security Center

vendor: Genetec Inc.

summary: SQL Injection affecting the Archiver role.


summary: The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

title: Tychesoftwares Order Delivery Date For Woocommerce security vulnerability


product: JKDEVKIT

vendor: jkdevstudio

summary: The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If WooCommerce is enabled, attackers will need Contributor-level access and above.

title: Jkdevstudio Jkdevkit security vulnerability


product: Email Notifications for Updates

vendor: aweos

summary: The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.

title: Aweos Email Notifications For Updates security vulnerability


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses.

title: Gitlab security vulnerability


product: Stop Spammers Classic

vendor: webguyio

summary: The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Webguyio Stop Spammers Classic security vulnerability


summary: An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.

title: Gitlab security vulnerability


summary: An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

title: Gitlab security vulnerability


product: Ninja Tables – Easy Data Table Builder

vendor: techjewel

vendor: wpmanageninja

summary: The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.

title: Wpmanageninja Ninja Tables security vulnerability


summary: The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.


vendor: glenwpcoder

summary: The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).

title: Glenwpcoder Drag And Drop Multiple File Upload For Woocommerce security vulnerability


vendor: Unknown

vendor: tychesoftwares

summary: The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information


product: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

vendor: jegtheme

summary: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Jegtheme Jeg Kit For Elementor – Powerful Addons For Elementor, Widgets… security vulnerability


product: pgAdmin 4

ecosystem: python/pypi

vendor: pgadmin

summary: Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.


summary: pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.


product: i

vendor: IBM

vendor: ibm

summary: IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system.


summary: IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.

title: Ibm I security vulnerability


product: Micro Mall

vendor: Bluestar

vendor: bluestar

summary: A vulnerability classified as critical has been found in Bluestar Micro Mall 1.0. Affected is an unknown function of the file /api/data.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.php?mod=upload&type=1. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: PyTorch

product: pytorch

vendor: linuxfoundation

summary: A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.


product: OpenManus

vendor: mannaandpoem

product: openmanus

summary: A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


vendor: TOTOLINK

vendor: totolink

summary: A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/ExportIbmsConfig.sh of the component IBMS Configuration File Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.