CVEs

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an…

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted…

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public…

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage…