CVE-2025-48979

A flaw was found in uisp. Improper input validation allows a command injection vulnerability, enabling a local attacker with high privileges to execute arbitrary commands. This exploitation occurs through crafted input to the application. The consequence of successful exploitation is limited to...

CVE-2025-50977

A template injection vulnerability in Gitblit version 1.7.1 allows authenticated administrators to execute arbitrary client-side code via reflected cross-site scripting (XSS) . The flaw originates from improper handling of the 'r' parameter , where attackers can inject malicious Angular expressio...

Google Chrome security vulnerabilities

Google Chrome is a WEB browser developed by Google Inc. A security vulnerability exists in Google Chrome V8, which can be exploited by a remote attacker to submit a special Web request, which induces the user to parse it, and can be used in the application context to execute arbitrary code...

D-Link DI-8400 security vulnerability

The D-Link DI-8400 is a wireless router from China-based AUO D-Link. The D-Link DI-8400 arpsysasp suffers from a buffer overflow vulnerability that can be exploited by a remote attacker to submit a special request that can crash the service program or execute arbitrary code in the application...

Cisco Identity Services Engine code-related vulnerabilities

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. The Cisco Identity Services Engine API interface has an XML external entity vulnerability that can be exploited by a remote attacker to submit a special request that can read arbitrary files in the...

CVE-2024-50344 I, Librarian has a Stored XSS vulnerability in Supplemental Files

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context...

SeaCMS security vulnerabilities

SeaCMS is an open source content management system based on PHP+MySql technology. A security vulnerability exists in the SeaCMS adminweixin.php processing parameter, which can be exploited by an authenticated remote attacker to submit a special request that can be used to execute arbitrary comman...

Code Injection

pug is vulnerable to Code execution. The vulnerability is due to the lack of proper input validation for the name option in the compileClient, compileFileClient, or compileClientWithDependenciesTracked functions, which allows attackers to execute arbitrary JavaScript code in the context of the...

CVE-2024-34089

An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When...

CVE-2024-23914

Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MCOpenAssociation function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception...

Merative Merge DICOM Toolkit security vulnerabilities

The Merative Merge DICOM Toolkit is a comprehensive API from Merative that complies with the latest DICOM standards. A security vulnerability exists in Merative Merge DICOM Toolkit C/C++ versions v5.6.0 through v.5.17.0, which stems from an unhandled exception that can be caused when using the...

YonBIP security vulnerabilities

YonBIP is a new generation of products developed by UFIDA, as the world's leading enterprise digital intelligence platform and application software. A file upload vulnerability exists in YonBIP, which can be exploited by an attacker to upload arbitrary files and execute arbitrary code in the...

Trend Micro Mobile Security for Enterprises ServerUpdate_UpdateSuccessful Cross-Site Scripting Vulnerability

This vulnerability allows remote attackers to execute web requests with the victim's privileges on affected installations of Trend Micro Mobile Security for Enterprises. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious...

Trend Micro Mobile Security for Enterprises vpplist_assign_list Cross-Site Scripting Vulnerability

This vulnerability allows remote attackers to execute web requests with the victim's privileges on affected installations of Trend Micro Mobile Security for Enterprises. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious...

SRC-2023-0004 : Apache Struts Security Feature Bypass Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability may allow remote attackers to execute arbitrary code on applications utilizing affected installations of Apache Struts. Depending on the context, authentication may not be required to exploit this vulnerability. The specific flaw exists within the...

File upload vulnerability in mojoPortal

mojoPortal is a cross-platform object-oriented web framework . A file upload vulnerability exists in mojoPortal, which can be exploited by a remote attacker to submit a special request that can upload malicious files and execute arbitrary code in the context of the application...

emlog pro /admin/plugin.php arbitrary file upload vulnerability

emlog is a lightweight blog and CMS builder based on PHP and MySQL. An arbitrary file upload vulnerability exists in emlog pro /admin/plugin.php, which can be exploited by a remote attacker to submit a special request that can upload a malicious file to execute arbitrary code in the application...

Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnection Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the doRTAAccessUPass method. The issue results from an exposed...

Adobe ColdFusion code vulnerabilities

Adobe ColdFusion is the United States of America Odo than Adobe company's set of rapid application development platform. Adobe ColdFusion suffers from a deserialization code execution vulnerability that can be exploited by a remote attacker to submit a special request to execute arbitrary code in...

Trend Micro Apex Central Cross-Site Scripting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Data...