CVE Vulnerability Catalog

Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload; when the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21.

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context. This issue was fixed in version 10.1.21.

Zoho Flow versions up to and including 2.14.5 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Gunslinger versions up to and including 1.11 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Good Homes versions up to and including 1.3.13 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

PHP Object Injection vulnerability in the Gamic theme in versions up to and including 1.19. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Gamezone theme in versions up to and including 1.1.11. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the EmojiNation theme in versions up to and including 1.0.12. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Edge Decor theme in versions up to and including 2.9. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Coinpress theme in versions up to and including 1.0.15. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Bonbon theme in versions up to and including 1.11. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Avventure theme in versions up to and including 1.1.12. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Filmax theme in versions up to and including 1.1.11. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Orpheus theme in versions up to and including 1.8. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Nuts theme in versions up to and including 1.12. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Muzicon theme in versions up to and including 1.15. It can be exploited by an unauthenticated attacker.