CVE-2018-25349

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attackers can send crafted requests to the backup.php endpoint with XSS payloads in the X-Forwarded-For header that execute when administrators...

CVE-2019-25349

creationtimestamp| type| source ---|---|--- 2026-02-20 03:40:12+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfb6qud6tq2u...

CVE-2021-25349

Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the PendingIntent...

CVE-2025-25349

creationtimestamp| type| source ---|---|--- 2025-02-12 16:16:46+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhyl4dedsw2x 2025-02-12 18:19:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lhyry4d26227 2025-02-12 18:33:21+00:00| seen|...

CVE-2025-25349

The CVE concerns PHPGurukul Daily Expense Tracker System v1.1. The vulnerability is a SQL Injection in the /dets/add-expense.php endpoint due to the costitem parameter. Affects PHP-MySQL stack as described; impact is rated HIGH for confidentiality, integrity, and availability (CVSS 3.1: 9.8). The...

CVE-2025-0899: Use After Free

PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a maliciou...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

Removed by vendor...

CVE-2022-25349 Cross-site Scripting (XSS)

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

CVE-2022-25349 affects materialize-css: XSS caused by improper escaping of user input in the autocomplete component, allowing input such as to be parsed as HTML/JavaScript and executed in the DOM. Connected sources (Veracode, OSV, SNYK) confirm all versions are vulnerable with the root cause in ...

CVE-2021-25349

Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the PendingIntent...

CVE-2021-25349

Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the PendingIntent...

CVE-2021-25349

The CVE-2021-25349 entry concerns the Slow Motion Editor. Affected: Slow Motion Editor versions prior to 3.5.18.5. Root cause: use of an unsafe PendingIntent that allows a local attacker to hijack PendingIntent and perform unauthorized actions without user permission. Impact details in sources in...