2025

A denial-of-service security issue exists in the affected product and version. The security issue stems from the control

A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the

A code execution security issue exists in the affected product. An attacker with physical access could abuse the mainten

A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of

A security issue exists in the protected mode of EN4TR devices, where sending specifically crafted messages during a For

A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent For

A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within th

A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guess

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat .

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs t

A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically af

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47,

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47,

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 l

An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulat

A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected applica

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes ce

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be sus

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC

A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All v

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions <

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insuffi

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordP

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordP

The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which cou

The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and

The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and

The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege u

The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024

A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_41502

A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/control

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 th

Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high priv

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through th

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could

When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of ce

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting spec

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbi

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access inter

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticate