CVE-2025-55886

CVE-2025-55886 描述 在ARD中发现了一个不安全的直接对象引用（IDOR）漏洞。该漏洞存在于支付历史API端点的feuid参数中。已认证的攻击者可以操纵此参数，未经授权访问其他用户的支付历史。 受影响组件 https://services.ard.fr/?eID=txafereloadrecords&dc=1743696277812&feuid=USERID&startTimestamp=1741017877&endTimestamp=1743782677&mobile=1&page=1&start=0&limit=100 受影响的产品代码库 ARD GEC en Lign...

CVE-2025-55885

CVE-2025-55885 描述 Alpes Recherche et Developpement ARD GEC en Ligne 2025-04-23 之前版本中存在SQL注入漏洞，允许远程攻击者通过 index.php 中的 GET 参数提升权限。 攻击向量 通过未清理的 GET 参数 ocid 在 https://services.ard.fr/index.php（交易确认页面）进行SQL注入。 概念验证 Payload sqlmap -u...

CVE-2025-55888

CVE-2025-55888 描述 在ARD的Ajax事务管理器端点中发现了一个跨站脚本XSS漏洞。攻击者可以拦截Ajax响应并在accountName字段中注入恶意JavaScript。该输入在渲染时未经过适当的清理或编码，导致脚本在用户浏览器上下文中执行。此漏洞可能导致会话劫持、Cookie窃取和其他恶意行为。 概念验证 Payload注入 漏洞截图 研究人员 tryon-dev...

CVE-2025-55887

CVE-2025-55887 描述 在餐饮预订服务 ARD 中发现了跨站脚本（XSS）漏洞。该漏洞存在于交易确认页面的 transactionID GET 参数中。由于不正确的输入验证和输出编码，攻击者可以注入恶意 JavaScript 代码，该代码在用户浏览器上下文中执行。这可能导致会话劫持、Cookie 窃取以及其他以受害者名义执行的恶意操作。 概念验证 负载...

EUVD-2025-30714

Malicious code in bioql PyPI...

CVE-2025-55887

Cross-Site Scripting XSS vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that ...

CVE-2025-55888

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

CVE-2025-55887

Cross-Site Scripting XSS vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that ...

CVE-2025-55888

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

CVE-2025-55887

Cross-Site Scripting XSS vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that ...

CVE-2025-55888: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

PT-2025-38756

Name of the Vulnerable Software and Affected Versions Alpes Recherche et Developpement ARD GEC en Lign versions prior to 2025-04-23 Description A SQL Injection issue exists in Alpes Recherche et Developpement ARD GEC en Lign. A remote attacker can potentially escalate privileges by manipulating t...

CVE-2025-55888

Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution i...

CVE-2025-55887

A Cross-Site Scripting (XSS) vulnerability exists in the ARD meal reservation service (specifically the online service portal ARD GEC en Ligne). The flaw is located in the transactionID GET parameter on the transaction confirmation page due to improper input validation and output encoding . An at...

ARD GEC en Lign 安全漏洞

ARD GEC en Ligne is an online service portal of ARD France. A security vulnerability exists in versions of ARD GEC en Lign prior to 2025-04-23, which stems from improper handling of the GET parameter in index.php, which could lead to SQL injection attacks and elevation of privilege...

ARD GEC en Ligne 安全漏洞

ARD GEC en Ligne is an online service portal of ARD France. A security vulnerability exists in ARD GEC en Ligne that stems from an Ajax transaction manager endpoint that does not properly clean or encode the accountName field, which could lead to a cross-site scripting attack...

CVE-2025-55885: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php...

CVE-2025-55885

Alpes Recherche et Developpement ARD GEC en Lign versions prior to v.2025-04-23 are vulnerable to a SQL Injection flaw in the index.php file. The root cause is the improper handling and lack of sanitization for the GET parameter ocid, specifically on the transaction confirmation page located at h...

CVE-2025-55885

SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php...

ARD GEC en Ligne 安全漏洞

ARD GEC en Ligne is an online service portal of ARD France. A security vulnerability exists in ARD GEC en Ligne that stems from an insecure direct object reference to the feuid parameter in the payment history API endpoint, which could lead to unauthorized access to another user's payment history...