Protégez vos données, renforcez Votre Cybersécurité

CVE-2025-9890 - HIGH
18/10/2025

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as cli...

csrfOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-5555 - HIGH
18/10/2025

A vulnerability has been found in Nixdorf Wincor PORT IO Driver up to 1.0.0.1. This affects the function sub_11100 in the library wnport.sys of the component IOCTL Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0.1 is able to mitigate this issue...

overflow

>> Plus d'informations avec CVE Find

CVE-2025-11391 - CRITICAL
18/10/2025

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While...

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2017-20206 - CRITICAL
18/10/2025

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2017-20207 - CRITICAL
18/10/2025

The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the `pager ` parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2017-20208 - CRITICAL
18/10/2025

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows a...

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-62515 - CRITICAL
17/10/2025

pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to...

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-62650 - HIGH
17/10/2025

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.

CVE-2025-62645 - CRITICAL
17/10/2025

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.

priviliegemanagementOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-11925 - CRITICAL
17/10/2025

Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVE-2025-56221 - CRITICAL
17/10/2025

A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.

OWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2025-62419 - HIGH
17/10/2025

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE values are directly concatenated into the JDBC URL without filtering illegal parameters. This allows a...

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-62420 - HIGH
17/10/2025

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vulnerability exists in the H2 database connection handler. The getJdbc function in H2.java checks if the jdbcUrl starts with jdbc:h2 but returns a separate jdbc field as the actual connection URL. An attacker can provide a jdbcUrl that starts with jdbc:h2 while supplying a different...

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-62422 - HIGH
17/10/2025

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in version 2.10.14. No known workarounds exist.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-62168 - CRITICAL
17/10/2025

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used int...

OWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-8414 - CRITICAL
17/10/2025

Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.

OWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-26625 - HIGH
17/10/2025

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull c...

OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-49655 - CRITICAL
17/10/2025

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-57567 - CRITICAL
17/10/2025

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands.

codeinjectionOWSAP: A03OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-60279 - CRITICAL
17/10/2025

A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API. An attacker can leverage this to enumerate open ports based on response discrepancies and interact with internal services.

ssrfOWSAP: A10

>> Plus d'informations avec CVE Find