Archive
26 August 2025
Vulnerabilities first published on this day (UTC), newest first.
56 results · Clear filters · Feed
-
Medium 4.4
All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authentic…
-
Medium 4.0CVE-2025-26417 Public exploit
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening fi…
-
Medium 4.0
In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This co…
-
Medium 5.5
In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. T…
-
Medium 6.5
In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficie…
-
Medium 6.2
In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission …
-
Medium 4.0
In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This …
-
Medium 5.5
In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across u…
-
Medium 5.5
In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of se…
-
Medium 6.4
SiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possibl…
-
Medium 4.1
Agiloft XML external entity local path traversal
Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft R…
-
Medium 5.9
Agiloft improper neutralization in EUI template engine
Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31.
-
Medium 5.3
GraphQL Armor Max-Depth Plugin Bypass via fragment caching
### Summary A query depth restriction using the max-depth can be bypassed if `ignoreIntrospection` is enabled (which is the default configuration) by naming your query/fragment `__schema`. ### Details In the `countDepth` function, we have the following code t…
-
Medium 5.3
GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
### Summary A query depth restriction using the `max-depth` property can be bypassed if `ignoreIntrospection` is enabled (which is the default configuration) by naming your query/fragment `__schema`. ### Details At the start of the `countDepth` function, we h…
-
Medium 6.3
Firecrawl SSRF Vulnerability via malicious webhook
Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an int…
-
Medium 6.1
IBM Cognos Command Center clickjacking
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click acti…
-
Medium 5.9
Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ
traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An at…
-
Medium 4.8
Privilege Escalation via get-task-allow entitlement in Invoice Ninja
Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access (e.g. via a malicious application) to attach a debugger, read or modify the process memory, i…
-
Medium 4.8
Privilege Escalation via get-task-allow entitlement in MacVim.app
MacVim's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access (e.g. via a malicious application) to attach a debugger, read or modify the process memory, inject c…
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Cursor
The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is …
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Nozbe
The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is l…
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Mosh-Pro
The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions. Acquired resource acces…
-
Medium 6.1
Arbitrary File Creation via Symbolic Link leading to Denial-of-Service
Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via sy…
-
Medium 4.3
Incorrect authorization for traces request/download in CMC before 25.1.0
An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited …
-
Medium 6.5
WordPress School Management Plugin <= 93.2.0 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects School Management: from n/a through 93.2.0.
-
Medium 4.7
WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthentic…
-
Medium 4.3
Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions
The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_fun…
-
Medium 5.5
EIP Builder XML External Entity Processing Information Disclosure Vulnerability
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability.
-
Medium 4.5
Mihomo Party Socket sysproxy.ts enableSysProxy temp file
A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. …
-
Medium 4.3
diyhi bbs File Compression FilePackageManageAction.java information disclosure
A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePackageManageAction.java of the component File Compression Handler. This manipulation of the argument i…
-
Medium 4.3
1000projects Online Project Report Submission and Evaluation System add_title.php cross site scripting
A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown functionality of the file /admin/add_title.php. Such manipulation of the argument Title leads to cros…
-
Medium 4.3
1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scripting
A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functionality of the file /rse/admin/edit_faculty.php?id=2. This manipulation of the argument Name causes c…
-
Medium 4.3
1000projects Online Project Report Submission and Evaluation System add_student.php cross site scripting
A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown function of the file /admin/add_student.php. The manipulation of the argument address results in cross site scripting. The a…
-
Medium 4.3
1000projects Online Project Report Submission and Evaluation System edit_title.php cross site scripting
A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/edit_title.php?id=1. Executing manipulation of the argument desc can lead to cross site scripting. T…
-
Medium 4.3
mtons mblog Admin Panel list cross site scripting
A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Performing manipulation of the argument Name results in cross site scripting. The attack may be initia…
-
Medium 4.3
mtons mblog Admin Panel list cross site scripting
A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Panel. Such manipulation of the argument Title leads to cross site scripting. The attack can be launched…
-
Medium 4.3
mtons mblog search cross site scripting
A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
-
Medium 6.1
Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part …
-
Medium 6.1
In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value…
-
Medium 5.3
An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker…