IBM Security Verify Governance Cross-Site Scripting Vulnerability (CNVD-2025-09286)

IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define and control user access and access risk. A cross-site scripting vulnerability exists in IBM Security Verify Governance...

CVE-2025-39567

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through = 1.7.8...

PT-2025-17042 · Unknown · Eazy Under Construction

Name of the Vulnerable Software and Affected Versions: Eazy Under Construction versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-16972 · Unknown · Studio Hyperset The Great Firewords Of China

Name of the Vulnerable Software and Affected Versions: Studio Hyperset The Great Firewords of China versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an...

CVE-2025-32859

The CVE-2025-32859 entry concerns Siemens TeleControl Server Basic prior to version V3.1.2.2, which is vulnerable to SQL injection via the internal LockWebServerGatewaySettings method. An authenticated attacker who can reach port 8000 can bypass authorization and read/write the application databa...

PT-2025-16266 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is an XPath injection vulnerability that could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document...

Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)

Exploit Title: Roundcube Webmail 1.6.6 - Stored Cross Site Scripting XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6 t...

Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2025-10035)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A cross-site scripting vulnerability exists in Apache OFBiz versions prior to 18.12.19, which stems from th...

CVE-2023-37930

creationtimestamp| type| source ---|---|--- 2025-04-08 14:47:17+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10924 2025-04-08 17:22:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmcygegpo62u 2025-04-08 18:11:08+00:00| seen| https://t.me/cvedetector/22471...

CVE-2025-30280

A vulnerability has been identified in Mendix Runtime V10 All versions V10.21.0, Mendix Runtime V10.12 All versions V10.12.16, Mendix Runtime V10.18 All versions V10.18.5, Mendix Runtime V10.6 All versions V10.6.22, Mendix Runtime V8 All versions V8.18.35, Mendix Runtime V9 All versions V9.24.34...

CVE-2025-31332

creationtimestamp| type| source ---|---|--- 2025-04-08 07:46:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10858 2025-04-08 09:18:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmc5ect2ru2i 2025-04-08 11:28:59+00:00| seen| https://t.me/cvedetector/22414...

CVE-2025-3426

We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-enginee...

CVE-2024-56475

creationtimestamp| type| source ---|---|--- 2025-04-02 19:07:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llu3i4vig224 2025-04-02 20:50:51+00:00| seen| https://t.me/cvedetector/21910...

Internet Bug Bounty: Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

The Apache Airflow Fab Provider before version 1.5.2 was affected by an insufficient session expiration vulnerability. When a user's password was changed using the admin CLI, the existing user sessions were not cleared, allowing logged-in users to continue accessing the system even after the...

PT-2025-14268 · Infoway Llc · Infoway Llc Ebook Downloader

Name of the Vulnerable Software and Affected Versions: Infoway LLC Ebook Downloader versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker c...

PT-2025-14129 · Unknown · Leadquizzes

Name of the Vulnerable Software and Affected Versions: LeadQuizzes versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious script...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Title/Body source fields. An attacker can inject malicious scripts by crafting malicious input to these fields. Details...

CVE-2025-1734

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when receiving headers from HTTP server, the headers missing a colon : are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers...

The vulnerability of the Application Security (AppSec) module of a software platform based on Git for collaborative code development on GitLab allows attackers to perform cross-site scripting attacks.

The vulnerability of the Application Security AppSec module of a Git-based software development platform for collaborative code editing on GitLab is related to the lack of protective measures for website structures. Exploiting this vulnerability allows an attacker operating remotely to perform...

CVE-2025-2909

CVE-2025-2909 affects DuoxMe (iOS) prior to version 3.3.1. The root cause is lack of encryption in the application binary, allowing an attacker to gain unauthorised access to the app code and discover sensitive information. Public details in connected documents explicitly describe the vulnerabili...