CVE-2025-41079 Multiple vulnerabilities in Seafile

A stored Cross-Site Scripting XSS vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'...

CVE-2025-45091

Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting XSS attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities...

GHSA-JQMC-FXXP-R589 Deserialization of Untrusted Data in Tendenci

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

Deserialization of untrusted data

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

PYSEC-2020-112

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

CVE-2020-14942

Tendenci 15.3.11 and earlier contains a critical deserialization vulnerability in the Helpdesk module (staff.py) where an authenticated user with Staff security level can trigger Remote Code Execution via pickle.loads in run_report(); ticket_list() uses safe JSON deserialization. This is a conseq...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py...

PT-2020-14078

Name of the Vulnerable Software and Affected Versions Tendenci version 12.0.10 Description The issue concerns unrestricted deserialization in the staff.py file located in apps/helpdesk/views/. This could potentially allow for malicious activities due to the lack of restrictions on what can be...

CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py. Recent assessments: kevthehermit at June 21, 2020 7:03pm UTC reported: Outline Untrusted data from the client side is used to create a python pickled object. This can lead to full RCE and compromise of the host...