vendor: SourceCodester

vendor: senior-walter

summary: A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add-admin.php of the component Create User Page. The manipulation of the argument Avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: Library Management System

vendor: itsourcecode

status: affected

ecosystem: java/maven

metric_type: Primary

severity: critical

metric_type: Secondary

severity: medium

part: a

vendor: angeljudesuarez

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: A vulnerability was found in itsourcecode Library Management System 1.0. It has been rated as critical. Affected by this issue is the function Search of the file library_management/src/Library_Management/Forgot.java. The manipulation of the argument txtuname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


default_status: affected

product: GitHub Enterprise Server

vendor: GitHub

status: unaffected

version_type: semver

ecosystem: software/application

severity: high

vendor: github

summary: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user interaction with the malicious elements. This vulnerability affected version 3.16.1 of GitHub Enterprise Server and was fixed in version 3.16.2. This vulnerability was reported via the GitHub Bug Bounty program.

title: Github Enterprise Server security vulnerability


default_status: unaffected

product: Contact Form 7

vendor: rocklobsterinc

ecosystem: php/wordpress

vendor: rocklobster

summary: The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.

title: Rocklobster Contact Form 7 security vulnerability


product: langflow

vendor: langflow-ai

known_ransomware_campaign_use: Known

notes: This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/advisories/GHSA-c995-4fw3-j39m ; https://nvd.nist.gov/vuln/detail/CVE-2025-3248

product: Langflow

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Langflow

vulnerability_name: Langflow Missing Authentication Vulnerability

author: Codex

content_markdown:
Langflow versions before `1.3.0` expose a critical code-injection path in the
`/api/v1/validate/code` endpoint. The vulnerable endpoint is reachable by a
remote unauthenticated caller and can execute attacker-controlled Python code in
the Langflow process context.

For Langflow deployments, the security boundary is not just package resolution.
The endpoint exists to validate custom component code, so the mergeable fix must
prove that validation requires the authenticated current user. Restricting the
feature to a trusted component-author or administrator is additional
defense-in-depth where the deployment has that role model; it is not the
upstream CVE patch. Public ingress must not reach the route during rollout, and
tests must not prove exposure by running exploit code. CISA added CVE-2025-3248
to the Known Exploited Vulnerabilities catalog, so exposed systems should also
review logs and rotate reachable secrets after patching.

## When to use it

- A repository deploys, builds, pins, vendors, or documents Langflow before
  `1.3.0`.
- Langflow is exposed through reverse proxies, gateways, Kubernetes ingress,
  tunnels, devcontainers, shared workbenches, or hosted notebooks.
- Custom component authoring, playground, code-validation, or workflow editing
  features can reach `/api/v1/validate/code`.
- You need a bounded PR or triage note that upgrades Langflow and proves code
  validation requires authentication before execution sinks, with role-based
  authorization added as defense-in-depth where the product supports it.

## Inputs

- Python dependency files, lockfiles, Dockerfiles, compose/Helm/K8s/Terraform
  manifests, gateway/proxy config, environment templates, SBOMs, deployment
  renders, and runbooks.
- Langflow version evidence, validation route ownership, auth dependencies,
  role model, ingress exposure, runtime isolation, logs, and credential
  rotation owners.
- Available dependency install, API auth tests, gateway policy tests, container
  build, deployment render, SBOM, and dependency/security scan commands.

## Affected versions

- **Vulnerable / NVD CPE:** `langflow` last-affects below **1.3.0**.
- **Fixed / GHAD first_patched:** `langflow` **1.3.0** and
  `langflow-base` **0.3.0**.
- **Fixed / NVD CPE:** NVD excludes **1.3.0** on the langflow
  product only. **0.3.0 is not an NVD langflow exclude.**
- **Do not invent:** flatten leftover **1.3.0** onto
  `langflow-base`, or invent a later 1.3.1 floor.
- **Affected endpoint:** `POST /api/v1/validate/code`
- **Weaknesses:** missing authentication for a critical function and improper
  control of code generation/execution.
- **CISA KEV:** yes; added 2025-05-05 with required action due 2025-05-26.

## Indicator-of-exposure

- The repository deploys, builds, vendors, pins, or documents Langflow
  `<1.3.0`.
- A reverse proxy, load balancer, API gateway, Kubernetes ingress, Codespace,
  tunnel, shared workbench, or developer container exposes Langflow beyond a
  single trusted local user.
- Custom component authoring, code validation, playground, API, or workflow
  editing features are enabled.
- Public or unauthenticated traffic can reach `/api/v1/validate/code` or a
  wrapper route that forwards to it.
- The Langflow process can reach model provider keys, database credentials,
  flow secrets, package tokens, cloud metadata, mounted source code, internal
  services, or writable deployment storage.

Quick checks:

```bash
rg -n "langflow|LANGFLOW|/api/v1/validate/code|validate/code|validate_code|custom component|component code|playground|ingress|traefik|nginx|gateway" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"
```

Windows:

```powershell
rg -n "langflow|LANGFLOW|/api/v1/validate/code|validate/code|validate_code|custom component|component code|playground|ingress|traefik|nginx|gateway" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"
```

Do not validate exposure by sending code payloads, running shell commands,
reading files, printing environment variables, or touching real flows.

## Remediation strategy

- Upgrade every controlled Langflow dependency, lockfile, image, Helm chart,
  compose service, deployment manifest, SBOM, and runbook to `langflow 1.3.0+`.
- Block unauthenticated access to `/api/v1/validate/code` at the application and
  gateway layers. If rollout is not atomic, temporarily deny the route at the
  edge until all runtimes are patched.
- Require the authenticated current user before accepting custom component code
  for validation. Where the deployment has a reviewed role model, also restrict
  that capability to a trusted component-author or administrator as
  defense-in-depth.
- Add regression tests that assert unauthenticated and low-privilege requests to
  the validation route fail before any code-validation or execution helper is
  invoked.
- Isolate Langflow with least privilege: remove cloud metadata reachability,
  avoid host mounts and Docker socket access, restrict egress, and keep secrets
  out of logs.
- Review application, gateway, process, and audit logs for unexpected
  `validate/code` traffic. Rotate Langflow, model provider, database, package,
  cloud, and workflow credentials when the endpoint was reachable by untrusted
  callers.

## The prompt

~~~markdown
Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2025-3248, a critical Langflow unauthenticated code
injection vulnerability in the `/api/v1/validate/code` endpoint before
Langflow 1.3.0. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades Langflow, blocks
  unauthenticated validation access, adds safe regression coverage, refreshes
  generated artifacts, and documents operator cleanup, or
- TRIAGE.md if this repository does not own an affected Langflow runtime or
  cannot make a safe change.

## Rules

- Scope only CVE-2025-3248 and directly related Langflow code-validation,
  authentication, authorization, ingress, runtime isolation, and credential
  cleanup.
- Treat Langflow flows, component code, prompts, model provider keys, database
  credentials, package tokens, cloud credentials, source checkouts, uploaded
  files, internal URLs, and logs as sensitive.
- Do not prove exposure by executing code payloads, spawning shells, reading
  local files, dumping environment variables, beaconing to external services,
  or touching production flows.
- Do not leave `/api/v1/validate/code` reachable to unauthenticated users as a
  default path.
- Do not rely on UI hiding, prompt instructions, scanner suppression, or
  network location as the only security control.
- Do not auto-merge.

## Steps

1. Inventory every Langflow runtime controlled by this repository:
   `pyproject.toml`, `requirements*.txt`, lockfiles, Dockerfiles, compose
   files, Helm charts, Kubernetes manifests, Terraform, gateway/proxy config,
   environment templates, CI images, SBOMs, generated deployment output, and
   runbooks.
2. Determine every resolved Langflow version. A target is vulnerable if it
   resolves to `langflow <1.3.0` or an owned fork that exposes
   `/api/v1/validate/code` before authenticating the current user.
3. Search for code-validation and exposure surfaces:
   - `/api/v1/validate/code`, `validate_code`, custom component validation, and
     playground/API routes;
   - route dependencies that load the current user or enforce permissions;
   - reverse-proxy, ingress, tunnel, Codespace, devcontainer, and shared
     workbench access to Langflow;
   - logs or analytics that may capture component code or validation errors.
4. If this repository does not deploy or package Langflow, stop with
   `TRIAGE.md` listing files checked, runtime owner if known, observed version
   evidence, and required fixed version `langflow 1.3.0+`.
5. Upgrade every controlled Langflow package and image to `1.3.0+`.
   Regenerate lockfiles, image digests, SBOMs, deployment render output,
   dependency reports, and documentation as this repository normally does.
6. Add containment for non-atomic rollouts:
   - deny `/api/v1/validate/code` at the gateway or reverse proxy until patched;
   - restrict Langflow to authenticated networks or single-user loopback where
     applicable;
   - disable custom component/code-validation features for untrusted users;
   - fail closed if the Langflow version or auth state cannot be determined.
7. Where this repository controls Langflow product code or local patches,
   enforce authentication before code validation and, as defense-in-depth,
   authorization where a reviewed role model exists:
   - require a current authenticated user before parsing or validating supplied
     code;
   - when supported, require administrator or trusted component-author
     permission for custom component validation;
   - ensure denied requests return before validation helpers, imports, exec-like
     paths, subprocesses, or dynamic loading are reached;
   - keep component code, tracebacks, environment values, and secrets out of
     logs and HTTP responses.
8. Add safe regression tests:
   - missing authentication gets `401` or `403`;
   - a low-privilege authenticated user cannot validate custom component code;
   - the denied path does not call the validation/execution helper;
   - the intended trusted role still works without logging submitted code;
   - gateway/rendered deployment config denies public unauthenticated access
     during rollout;
   - dependency policy rejects `langflow <1.3.0`.
9. Harden runtime exposure where this repository controls deployment:
   - remove Docker socket and broad host mounts from Langflow containers;
   - run with a least-privilege service identity and read-only filesystem where
     practical;
   - block cloud metadata access and unnecessary outbound egress;
   - keep provider keys, database credentials, package tokens, and flow secrets
     out of environment snapshots, logs, and screenshots.
10. Add a PR body section named `CVE-2025-3248 operator actions` that states:
    - Langflow versions before and after;
    - whether `/api/v1/validate/code` was reachable beyond loopback or trusted
      networks;
    - whether unauthenticated callers could reach the route before the patch;
    - whether custom component/code-validation features are enabled and for
      which roles;
    - which logs were reviewed for validation-route traffic;
    - which Langflow, model provider, database, package, cloud, and workflow
      credentials should be rotated or why rotation is not required;
    - any temporary edge block that must remain until deployment completes.
11. Run relevant validation: dependency install, lockfile integrity, unit/API
    auth tests, gateway policy tests, container build, deployment render,
    SBOM refresh, dependency/security scans, and a non-exploit local smoke test
    that proves denial without executing submitted code.
12. Use PR title:
    `fix(sec): remediate CVE-2025-3248 in Langflow`.

## Stop conditions

- No affected Langflow runtime is controlled by this repository.
- Langflow is present only in prose or externally owned infrastructure; document
  owner, version evidence, exposure, and required fixed version in `TRIAGE.md`.
- A fixed Langflow version cannot be consumed without a broader migration and
  the repository cannot safely block the route at the edge.
- Product requirements intentionally expose unauthenticated code validation;
  document the risk and require a product/security decision.
- Meaningful verification would require executing attacker-controlled code,
  accessing production flows, or exposing secrets.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.
~~~

## Rollback

Do not roll back into GHAD first_patched `langflow` below **1.3.0**
or `langflow-base` below **0.3.0**. Do not flatten leftover **1.3.0**
onto `langflow-base`. If the patched
release must be withdrawn, keep `/api/v1/validate/code` denied at the gateway or
stop the public service until another fixed release is installed; roll back
unrelated configuration separately.

## Verification - what the reviewer looks for

- No controlled dependency, image, SBOM, deployment target, or runbook resolves
  Langflow `<1.3.0`.
- `/api/v1/validate/code` requires authentication before any code-validation
  helper, dynamic import, exec-like path, or subprocess sink is reachable.
- Where a reviewed role model is implemented, non-admin or untrusted users
  cannot validate custom component code unless that role explicitly owns the
  capability.
- Gateway or reverse-proxy containment is present when patched runtimes cannot
  roll out atomically.
- Tests prove denied requests do not execute submitted code and do not log
  component source or secrets.
- Operator notes cover KEV urgency, log review, credential rotation, and any
  temporary edge block.

## Output contract

- Reviewer-ready PR upgrading Langflow to `1.3.0+` across dependencies, images,
  manifests, generated artifacts, SBOMs, and docs.
- Authentication is enforced before `/api/v1/validate/code` reaches validation,
  dynamic import, exec-like helpers, subprocesses, or code-loading sinks;
  role authorization is an additional control where locally supported.
- Safe regression tests proving unauthenticated and low-privilege requests are
  denied without executing submitted code or logging component source/secrets.
- `TRIAGE.md` when Langflow runtime, ingress, rollout, or credential cleanup
  ownership is outside this repository.

## Watch for

- Updating one `requirements.txt` while a Docker image, Helm values file,
  compose service, CI image, or managed platform still runs an older Langflow.
- Fixing the browser UI while leaving the API route or an internal wrapper
  unauthenticated.
- Testing with live exploit payloads, production flows, real provider keys, or
  environment dumps.
- Logging submitted component code, tracebacks with secrets, or authorization
  bearer tokens while adding tests.
- Treating a private network as sufficient protection for shared developer
  workbenches, hosted notebooks, remote IDEs, or exposed preview deployments.
- Stopping at Langflow `1.3.0` after this CVE. Default deployments through
  `1.10.0` remain exposed to CVE-2026-9198 until `1.10.1`.

## Related recipes

- [CVE-2026-55255 Langflow responses IDOR]({{< relref "/recipes/cve/cve-2026-55255-langflow-authorization-bypass-through-user-controlled-key-vulnerability" >}})
- [CVE-2026-9198 Langflow auto-login RCE]({{< relref "/recipes/cve/cve-2026-9198-langflow-auto-login-validate-code-rce" >}})
- [Search the CVE Database for CVE-2025-12735](/cve-database/?q=CVE-2025-12735#cve-catalog)
- [Search the CVE Database for CVE-2026-5760](/cve-database/?q=CVE-2026-5760#cve-catalog)
- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})

## References

- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2025-3248>
- CISA KEV catalog entry: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3248>
- Langflow advisory: <https://github.com/langflow-ai/langflow/security/advisories/GHSA-rvqx-wpfh-mfx7>
- Langflow 1.3.0 release: <https://github.com/langflow-ai/langflow/releases/tag/1.3.0>
- Fix PR: <https://github.com/langflow-ai/langflow/pull/6911>
- CVE record: <https://www.cve.org/CVERecord?id=CVE-2025-3248>

description: CVE-2025-3248 leftover. GHAD first_patched langflow 1.3.0 and langflow-base 0.3.0. NVD CPE excludes 1.3.0. Do not flatten 1.3.0 onto langflow-base.

maturity: stable

model: GPT 5.5 Extra High reasoning

title: CVE-2025-3248: Langflow Unauthenticated RCE Remediation

vendor: langflow

quality: curated

recipe_kind: markdown-override

summary: Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.


vendor: TOTOLINK

ecosystem: operating-system

part: o

vendor: totolink

summary: A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: eladmin

vendor: elunez

vendor: eladmin

summary: A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: admintwo

vendor: xujiangfei

severity: low

summary: A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


archetype: ssrf

summary: A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/home. The manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/updateSet. The manipulation of the argument email leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


product: Old Age Home Management System

vendor: PHPGurukul

vendor: phpgurukul

summary: A vulnerability classified as critical was found in PHPGurukul Old Age Home Management System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


vendor: Tenda

vendor: tenda

summary: A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Grafana

vendor: Grafana

status: Deferred

summary: A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

title: Grafana security vulnerability


product: huggingface/transformers

vendor: huggingface

version: unspecified

version_type: custom

product: transformers

summary: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

title: Huggingface Transformers security vulnerability


summary: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\.(.*)\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.


ecosystem: python/pypi

summary: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.


product: e-Diary Management System

summary: A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: TinyWebServer

vendor: qinguoyi

product: tinywebserver

summary: A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0. Affected by this issue is some unknown functionality of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Operations Bridge Manager

vendor: OpenText™

summary: Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password without providing their old password. This issue affects Operations Bridge Manager: 24.2, 24.4.


product: Themesflat Addons For Elementor

vendor: themesflat

summary: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider widget in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Themesflat Themesflat Addons For Elementor security vulnerability


vendor: sktthemes

summary: The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Sktthemes Skt Blocks security vulnerability


product: sqlite

vendor: SQLite

vendor: sqlite

summary: An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.


product: UrbanGo Membership

vendor: Edge-Themes

summary: The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_register_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.

title: Gitlab security vulnerability


product: ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)

vendor: elextensions

summary: The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Elextensions Elex Woocommerce Bulk Edit Products, Prices & Attributes (… security vulnerability


product: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

vendor: wpeverest

summary: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin.

title: Wpeverest User Registration & Membership – Free & Paid Memberships, Sub… security vulnerability


summary: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.

title: Wpeverest User Registration & Membership security vulnerability


product: User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin

vendor: WPEverest

summary: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Wpeverest User Registration Pro – Custom Registration Form, Login Form… security vulnerability


product: Arena®

vendor: Rockwell Automation

version: 16.20.08 and earlier

product: arena

vendor: rockwellautomation

summary: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

title: Rockwellautomation Arena security vulnerability


summary: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.


title: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow


summary: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.


product: WP Editor

vendor: benjaminprojas

vendor: benjaminrojas

summary: The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.

title: Benjaminrojas Wp Editor security vulnerability


summary: The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.


product: Online Eyewear Shop

vendor: SourceCodester

summary: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_product. The manipulation of the argument brand leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


summary: A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The manipulation of the argument email leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: Men Salon Management System

vendor: PHPGurukul

vendor: phpgurukul

summary: A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


vendor: ludwigyou

summary: The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information.

title: Ludwigyou Wpmastertoolkit (Wpmtk) – All In One Plugin security vulnerability


product: Xagio SEO – AI Powered SEO

vendor: xagio

summary: The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.

title: Xagio Xagio Seo – Ai Powered Seo security vulnerability


product: Patient Record Management System

vendor: code-projects

summary: A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Blood Bank Management System

summary: A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /don.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


summary: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


vendor: adonesevangelista

summary: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /viewrequest.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/campsdetails.php. The manipulation of the argument hospital leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /admin/delete.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in PHPGurukul Men Salon Management System 1.0. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, has been found in PHPGurukul Men Salon Management System 1.0. This issue affects some unknown processing of the file /admin/add-customer-services.php. The manipulation of the argument sids[] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in PHPGurukul Men Salon Management System 1.0. Affected is an unknown function of the file /admin/add-customer.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


product: Apartment Visitor Management System

summary: A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /forgotpw.php. The manipulation of the argument secode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-report.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/search-invoices.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: opencms

vendor: fumiao

summary: A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The manipulation of the argument path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.


product: company-financial-management 公司财务管理系统

vendor: Kenj_Frog 肯尼基蛙

vendor: kennifrog

summary: A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.


product: Spectrum Protect Server

vendor: IBM

vendor: ibm

summary: IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources.

title: Ibm Spectrum Protect Server security vulnerability


product: Tivoli Monitoring

summary: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

title: Ibm Tivoli Monitoring security vulnerability


product: OnlineSuite

vendor: B. Braun Melsungen AG

summary: A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.


summary: An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server.


product: Nimrod

vendor: godcheese

product: nimrod

status: Modified

summary: A vulnerability classified as critical was found in godcheese/code-projects Nimrod 0.8. Affected by this vulnerability is the function searchAllByName of the file ViewMenuCategoryRestController.java. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: iboot 物联网网关

vendor: iteaj

product: iboot

summary: A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


vendor: Tenda

vendor: tenda

summary: A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid/timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


product: Online Restaurant Management System

vendor: codeprojects

summary: A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservation_save.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


summary: A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. This issue affects some unknown processing of the file /payment_save.php. The manipulation of the argument mode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menu_update.php. The manipulation of the argument menu leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_save.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/category_update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/member_save.php. The manipulation of the argument last leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/member_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/user_save.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


summary: A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user_update.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/combo_update.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. This affects an unknown part of the file /admin/reservation_view.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/payment_save.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/reservation_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/assign_save.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/combo.php. The manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Tenda AC7 15.03.06.44. It has been rated as critical. Affected by this issue is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument pptp_server_start_ip/pptp_server_end_ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_pending.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. This vulnerability affects unknown code of the file /edit_dpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


product: FTP Server

vendor: PCMan

vendor: pcman

summary: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SYST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Old Age Home Management System

vendor: PHPGurukul

vendor: phpgurukul

summary: A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/view-enquiry.php. The manipulation of the argument viewid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-scdetails.php. The manipulation of the argument contnum leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: Men Salon Management System

summary: A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/add-services.php. The manipulation of the argument cost leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.


less_than_or_equal: 6.3.0.7 Service Pack 21

summary: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.


summary: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.


summary: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code due to improper validation of an index value of a dynamically allocated array.


product: Red Hat Enterprise Linux 7

vendor: Red Hat

product: Red Hat Enterprise Linux 8

part: redhat

summary: A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.

title: A flaw was found in GNUPlot


product: iSherlock 4.5

vendor: HGiga

product: iSherlock 5.5

summary: The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

title: Hgiga Isherlock 4.5 security vulnerability


product: PowerStation

summary: The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access the entire file system.

title: Hgiga Powerstation security vulnerability


summary: A missing protection against path traversal allows to access any file on the server.


product: Novel-Plus

vendor: xxyopen

product: novel-plus

summary: A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


summary: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component DELETE Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component MKDIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component SITE CHMOD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component CCC Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component CDUP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component CONF Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component ENC Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component EPRT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. Affected by this vulnerability is an unknown functionality of the component EPSV Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. Affected by this issue is some unknown functionality of the component FEAT Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: youkefu

summary: A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of the component File Upload. The manipulation of the argument ID leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


vendor: joey-zhou

summary: A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical. This vulnerability affects the function update of the file /api/user/update. The manipulation of the argument state leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

title: Joey-Zhou Xiaozhi-Esp32-Server-Java security vulnerability


vendor: SourceCodester

vendor: senior-walter

summary: A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /search/search_sales.php. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Human Resource Management System

vendor: 1000 Projects

summary: A vulnerability was found in 1000 Projects Human Resource Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /controller/employee.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


product: pb-cms

vendor: LinZhaoguan

summary: A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Classification Management Page. The manipulation of the argument Classification name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin#links of the component Friendship Link Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: renren-security

vendor: renrenio

summary: A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0. This affects an unknown part of the component JSON Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.


summary: A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.


summary: A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file cn/gson/oass/controller/daymanager/DaymanageController.java of the component Backend. The manipulation of the argument scheduleList leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.


summary: A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The manipulation of the argument outtype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.


summary: A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argument MailNumberId leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.


product: springboot-ucan-admin

vendor: mrcen

summary: A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an unknown part of the file /ucan-admin/index of the component Personal Settings Interface. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.


product: Automation Builder

vendor: ABB

vendor: abb

summary: Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.

title: Abb Automation Builder security vulnerability


summary: Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.

title: Gitlab security vulnerability


product: YzmCMS

product: yzmcms

vendor: yzmcms

summary: A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: VBlog

vendor: lenve

product: vblog

summary: A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: CDG

vendor: ESAFENET

product: cdg

vendor: esafenet

summary: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by this issue is some unknown functionality of the file /pubinfo/updateNotice.jsp. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unknown part of the file /client/UnChkMailApplication.jsp. The manipulation of the argument typename leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability has been found in ESAFENET CDG 5.6.3.154.205_20250114 and classified as critical. This vulnerability affects unknown code of the file /parameter/getLimitIPList.jsp. The manipulation of the argument noticeId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


vendor: Seeyon

vendor: seeyon

summary: A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown processing of the file /sysform/042/check.js%70. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: NVR ND8422P

vendor: Vivotek

product: NVR ND9525P

product: NVR ND9541P

summary: A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: Download Manager

summary: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

title: Codename065 Download Manager security vulnerability


product: appclientefiel

vendor: FCJ Venture Builder

archetype: generic

summary: A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDER_ID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: stb

vendor: Nothings

vendor: nothings

summary: A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack can be launched remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.


product: AIAS

vendor: mymagicpower

product: aias

vendor: aias

summary: A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3_api_platform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: springboot-admin

vendor: opplus

summary: A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.


product: Structured Content (JSON-LD) #wpsc

vendor: Unknown

summary: The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

title: Structured Content (Json-Ld) #Wpsc security vulnerability


product: Grafana

vendor: Grafana

summary: Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01


product: Embedder

vendor: stringfold

summary: The Embedder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_set_global_option() function in versions 1.3 to 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

title: Stringfold Embedder security vulnerability


product: WPC Admin Columns

vendor: wpclever

summary: The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.


product: Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

vendor: arraytics

product: eventin

vendor: themewinter

summary: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.

title: Themewinter Eventin security vulnerability


product: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

vendor: wpeverest

summary: The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Wpeverest Everest Forms security vulnerability


summary: The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.


product: Aspera Faspex

vendor: IBM

ecosystem: javascript/npm

vendor: ibm

summary: IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


product: IntelliSpace Portal

vendor: Philips

version: 12 and prior

summary: The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the "Object Marshalling" technique, which allows an attacker to read internal files without any authentication. This is possible by crafting specific .NET Remoting URLs derived from information enumerated in the client-side configuration files. This issue affects IntelliSpace Portal: 12 and prior.


summary: The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is dangerous as it can potentially lead to remote code execution using deserialization. This issue affects IntelliSpace Portal: 12 and prior.


product: Advanced Visualization Workspace

summary: We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-engineer the application to gain insights into its internal workings, which can potentially lead to the discovery of sensitive information, business logic flaws, and other vulnerabilities. Utilizing this flaw, the attacker was able to identify the Hardcoded credentials from PortalUsersDatabase.dll, which contains .NET remoting definition. Inside the namespace PortalUsersDatabase, the class Users contains the functions CreateAdmin and CreateService that are used to initialize accounts in the Portal service. Both CreateAdmin and CreateService functions contain a hardcoded encrypted password along with its respective salt that are set with the function SetInitialPasswordAndSalt. This issue affects IntelliSpace Portal: 12 and prior; Advanced Visualization Workspace: 15.


product: 3DPrint Lite

vendor: fuzzoid

summary: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Wp3Dprinting 3Dprint Lite security vulnerability


summary: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


summary: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


summary: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'printer_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


vendor: ZoomIt

product: zoomsounds

vendor: digitalzoomstudio

summary: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

title: Digitalzoomstudio Zoomsounds security vulnerability


product: AAWP Obfuscator

vendor: elpix

summary: The AAWP Obfuscator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-aawp-web' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Elpix Aawp Obfuscator security vulnerability


product: Advanced Advertising System

vendor: smartdevth

summary: The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient validation on the redirect url supplied via the 'redir' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.


product: SMTP for Amazon SES – YaySMTP

vendor: yaycommerce

summary: The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Yaycommerce Smtp For Amazon Ses – Yaysmtp security vulnerability


product: Mang Board WP

vendor: kitae-park

summary: The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Kitae-Park Mang Board Wp security vulnerability


vendor: gdragon

summary: The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Gdragon Coreactivity: Activity Logging For Wordpress security vulnerability


vendor: stylemix

vendor: stylemixthemes

summary: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in the ajax_actions.php file in all versions up to, and including, 1.4.66. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute several initial set-up actions.

title: Stylemixthemes Motors - Car Dealer, Classifieds & Listing security vulnerability


vendor: inspireui

summary: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.

title: Inspireui Mstore Api security vulnerability


summary: The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'field_value' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.


product: Security Guardium

summary: IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.


product: Tapo H200 V1 IoT Smart Hub

vendor: TP-Link

summary: This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.

title: Tp-Link Tapo H200 V1 Iot Smart Hub security vulnerability


product: ServiceDesk Plus MSP

vendor: ManageEngine

product: SupportCenter Plus

vendor: zohocorp

summary: Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

title: Zohocorp Manageengine Servicedesk Plus Msp security vulnerability


version_type: go

summary: A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir), A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be overwritten, potentially leading to privilege escalation, code execution, and other severe outcomes in some cases. It's worth noting that a similar vulnerability was found in TAR files (CVE-2024-0406). Although a fix was implemented, it hasn't been officially released, and the affected project has since been deprecated. The successor to mholt/archiver is a new project called mholt/archives, and its initial release (v0.1.0) removes the Unarchive() functionality.


product: Mattermost

vendor: Mattermost

vendor: mattermost

summary: Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

title: Mattermost Mattermost Server security vulnerability


product: Automation Runtime

vendor: B&R Industrial Automation GmbH

summary: Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session

title: B&R Industrial Automation Gmbh Automation Runtime security vulnerability


summary: A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.


vendor: B&R Industrial Automation

summary: An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.

title: B&R Industrial Automation Automation Runtime security vulnerability


product: SecuPress with Simple SSL – Simple and Performant Security

vendor: secupress

product: secupress

summary: The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secupress_reinstall_plugins_admin_ajax_cb' function in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins.

title: Secupress security vulnerability


product: Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content

vendor: saadiqbal

summary: The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.

title: Saadiqbal Password Protected — Lock Entire Site, Pages, Posts, Categori… security vulnerability


product: Grafana

vendor: Grafana

product: Grafana Enterprise

summary: This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

title: Grafana security vulnerability


product: 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone

summary: The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'start_restore' function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: 1Clickmigration 1 Click Migration & Backup: Free Wordpress Migration Pl… security vulnerability