Know your exposure.
Stay ahead of threats.

Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can…

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the st…

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarP…

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to t…

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory befor…

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.