آخرین آسیب‌پذیری‌ها

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain …

Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow

Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter

Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi

a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter