Protégez vos données, renforcez Votre Cybersécurité

CVE-2025-54075 - HIGH
18/07/2025

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `` element. The `` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load s...

crosssitescriptingOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-54079 - CRITICAL
18/07/2025

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the endpoint `/html/atendido/Profile_Atendido.php`, in the `idatendido` parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.4.6...

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-7790 - HIGH
18/07/2025

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. This affects an unknown part of the file /menu_nat.asp of the component HTTP Request Handler. The manipulation of the argument out_addr/in_addr/out_port/proto leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-49484 - HIGH
18/07/2025

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-49485 - HIGH
18/07/2025

A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-49486 - HIGH
18/07/2025

A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.

crosssitescriptingOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-7444 - CRITICAL
18/07/2025

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not hav...

OWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2025-6222 - CRITICAL
18/07/2025

The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's s...

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-6718 - HIGH
18/07/2025

The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-7643 - CRITICAL
18/07/2025

The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-3740 - HIGH
18/07/2025

The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass...

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-6813 - HIGH
18/07/2025

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges.

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-6185 - HIGH
17/07/2025

Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service.

crosssitescriptingOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-7762 - HIGH
17/07/2025

A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_nat_more.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-7398 - HIGH
17/07/2025

Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.

OWSAP: A02

>> Plus d'informations avec CVE Find

CVE-2025-7758 - HIGH
17/07/2025

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be use...

overflow

>> Plus d'informations avec CVE Find

CVE-2025-0886 - HIGH
17/07/2025

An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges.

OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-23266 - CRITICAL
17/07/2025

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-23267 - HIGH
17/07/2025

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering and denial of service.

OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-4657 - HIGH
17/07/2025

A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Lenovo App Store could allow a local attacker with elevated privileges to execute arbitrary code.