CVE Brief Security Intelligence

Several services in Honor Device Co

A vulnerability was found in D-Link DI-8100 16

A vulnerability classified as critical has been found in D-Link DIR-513 1

A vulnerability has been found in Tenda AC5 15

A vulnerability was found in Tenda AC5 15

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4

Dell OpenManage Network Integration, versions prior to 3

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates

A vulnerability classified as critical has been found in TOTOLINK A3002RU 3

A vulnerability classified as critical was found in TOTOLINK A702R 4

A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3

YONO SBI: Banking & Lifestyle v1

Misconfigured settings in IITB SSO v1

The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the doFieldAjaxAction() function in all versions up to, and including, 3

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 1

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function in all versions up to, and including, 2

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1

The target device exposes a service on a specific TCP port with a configured endpoint

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network

The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1

Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication

The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2

Deserialization of Untrusted Data vulnerability in designthemes Red Art allows Object Injection

A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2

The application is vulnerable to SQL injection attacks

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience

Short Description is a MediaWiki extension that provides local short description support

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup All In One Slider Responsive allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Cool fade popup allows Blind SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce allows SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory allows SQL Injection

In Tenable Nessus versions prior to 10

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data

Type confusion in V8 in Google Chrome prior to 138

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4

The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1

Tenda AC6 v15

Tenda AC6 v15

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme allows PHP Local File Inclusion

Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels

Tunnelblick 3

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology

Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

mtr through 0

Mbed TLS before 3

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA allows Path Traversal

The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker

During startup, the device automatically logs in the EPC2 Windows user without requesting a password

A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1

The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication

A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1

A vulnerability in HPE Insight Remote Support (IRS) prior to v7

A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7

@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6

The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks

The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks

The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks

Tenda AC6 v15

Tenda AC6 v15

Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE

Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE

Next

The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1

The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1

The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions allows PHP Local File Inclusion

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi allows PHP Local File Inclusion

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions allows SQL Injection

Path Traversal vulnerability in VaultDweller Leyka allows PHP Local File Inclusion

In Alinto SOPE SOGo 2

In the Production Environment extension in Netmake ScriptCase through 9

Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun

Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability is associated with program files apps/lzma/src/LzmaEnc

No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network

The web application is susceptible to cross-site-scripting attacks

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic

A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2

A vulnerability classified as critical has been found in SourceCodester Simple Company Website 1

A vulnerability, which was classified as critical, was found in PHPGurukul Teachers Record Management System 2

A vulnerability was found in PHPGurukul Teachers Record Management System 2

A vulnerability was found in code-projects Movie Ticketing System 1

A vulnerability classified as critical has been found in code-projects Inventory Management System 1

A vulnerability was found in code-projects Inventory Management System 1